Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.8

Chrome on Debian could let attacker corrupt memory

CVE-2023-1528 · published 3 years ago
Summary

The Chrome browser used in Debian can be tricked into using memory that has already been released, which may let a remote attacker who has already gained limited access cause the program to behave unexpectedly or crash. This could be used to further compromise the system. Updating Chrome to the latest version or applying the vendor's security patch resolves the risk.

What to do
  • Update debian chromium to version 111.0.5563.110-1.
  • Update google chrome to version 111.0.5563.110 or later.
Affected software
Ecosystem VendorProductAffected versions
Debian:12 debian chromium < 111.0.5563.110-1
Fix: upgrade to 111.0.5563.110-1
Debian:13 debian chromium < 111.0.5563.110-1
Fix: upgrade to 111.0.5563.110-1
Debian:14 debian chromium < 111.0.5563.110-1
Fix: upgrade to 111.0.5563.110-1
– google chrome < 111.0.5563.110
cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
– fedoraproject fedora 36
37
38
cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*
Original advisory text
Use after free in Passwords in Google Chrome prior to 111.0.5563.110 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML pag...
Use after free in Passwords in Google Chrome prior to 111.0.5563.110 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
8.8 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-416Use After Free
Timeline
Published21 Mar 2023
Updated4 Nov 2026
First seen15 Sep 2026
Sources
DEBIAN-CVE-2023-1528 · OSV
CVE-2023-1528 · NVD
Track software like this
Free during beta