Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.8
CVE-2023-5187: Chrome extensions could let a malicious add‑on corrupt memory
CVE-2023-5187 · published 3 years ago
Summary
Older versions of Chrome (before 117.0.5938.132) let a specially crafted extension cause memory corruption when a user visits a crafted web page. This can potentially let an attacker run unwanted code on the computer. Update Chrome/Chromium to the latest version and only install trusted extensions.
What to do
- Update debian chromium to version 117.0.5938.132-1~deb12u1.
- Update debian chromium to version 117.0.5938.132-1.
- Update google chrome to version 117.0.5938.132 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:12 | debian | chromium |
< 117.0.5938.132-1~deb12u1 Fix: upgrade to 117.0.5938.132-1~deb12u1
|
| Debian:13 | debian | chromium |
< 117.0.5938.132-1 Fix: upgrade to 117.0.5938.132-1
|
| Debian:14 | debian | chromium |
< 117.0.5938.132-1 Fix: upgrade to 117.0.5938.132-1
|
| – | chrome |
< 117.0.5938.132 cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* |
|
| – | debian | debian_linux |
11.0 12.0 cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* |
| – | fedoraproject | fedora |
37 38 39 cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* |
Original advisory text
Use after free in Extensions in Google Chrome prior to 117.0.5938.132 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted ...
Use after free in Extensions in Google Chrome prior to 117.0.5938.132 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
References
- https://security-tracker.debian.org/tracker/CVE-2023-5187 Vendor Advisory
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5508 Third Party Advisory
- https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_... Release Notes Vendor Advisory
- https://crbug.com/1475798 Permissions Required
- https://lists.fedoraproject.org/archives/list/[email protected]... Mailing List Third Party Advisory
- https://lists.fedoraproject.org/archives/list/[email protected]... Mailing List Third Party Advisory
- https://lists.fedoraproject.org/archives/list/[email protected]... Mailing List Third Party Advisory
Severity
8.8
High
Type
CWE-416Use After Free
Timeline
Published28 Sep 2023
Updated4 Nov 2026
First seen15 Sep 2026
Track software like this
Free during beta