Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.8
CVE-2023-4572: Chrome < 116 allows remote memory corruption via web page
CVE-2023-4572 · published 3 years ago
Summary
The Chromium browser shipped in Debian versions earlier than 116 can be tricked by a specially crafted web page into corrupting its memory. This could let a remote attacker take control of the browser process. Update Chromium to version 116.0.5845.140 or later to fix the issue.
What to do
- Update debian chromium to version 116.0.5845.140-1~deb12u1.
- Update debian chromium to version 116.0.5845.140-1.
- Update google chrome to version 116.0.5845.140 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:12 | debian | chromium |
< 116.0.5845.140-1~deb12u1 Fix: upgrade to 116.0.5845.140-1~deb12u1
|
| Debian:13 | debian | chromium |
< 116.0.5845.140-1 Fix: upgrade to 116.0.5845.140-1
|
| Debian:14 | debian | chromium |
< 116.0.5845.140-1 Fix: upgrade to 116.0.5845.140-1
|
| – | chrome |
< 116.0.5845.140 cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* |
|
| – | fedoraproject | fedora |
37 38 39 cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* |
| – | debian | debian_linux |
11.0 12.0 cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* |
Original advisory text
Use after free in MediaStream in Google Chrome prior to 116.0.5845.140 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Use after free in MediaStream in Google Chrome prior to 116.0.5845.140 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
References
- https://security-tracker.debian.org/tracker/CVE-2023-4572 Vendor Advisory
- https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop_... Release Notes Vendor Advisory
- https://crbug.com/1472492 Permissions Required
- https://lists.fedoraproject.org/archives/list/[email protected]... Mailing List
- https://lists.fedoraproject.org/archives/list/[email protected]... Mailing List
- https://lists.fedoraproject.org/archives/list/[email protected]... Mailing List
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5487 Third Party Advisory
Severity
8.8
High
Type
CWE-416Use After Free
Timeline
Published29 Aug 2023
Updated4 Nov 2026
First seen15 Sep 2026
Track software like this
Free during beta