CVE-2023-4762
Google Chromium V8 Type Confusion Vulnerability
Description
CVE-2023-4762 is a Type Confusion vulnerability (CWE-843) in the V8 JavaScript engine used by Google Chrome prior to version 116.0.5845.179, as well as downstream products including Microsoft Edge (Chromium-based) and Debian/Fedora Linux distributions. This type confusion flaw allows a remote attacker to execute arbitrary code by luring a victim to a specially crafted HTML page — requiring only a single user interaction with no authentication or privileges needed. CISA has confirmed that CVE-2023-4762 is actively exploited in the wild and added it to the Known Exploited Vulnerabilities catalog, with a remediation deadline of February 27, 2024. The EPSS score of 54.8% (98.0th percentile) reflects significant real-world exploitation probability for this Chrome V8 security vulnerability.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| chrome | < 116.0.5845.179 | |
| debian | debian linux | 11.0; 12.0 |
| fedoraproject | fedora | 37; 38; 39 |
| microsoft | edge chromium | < 116.0.1938.76 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop.html(Vendor Advisory)
- https://crbug.com/1473247(Permissions Required)
- https://lists.fedoraproject.org/archives/list/[email protected]/message/27NR3KG553CG6LGPMP6SHWEVHTYPL6RC/(Mailing List)
- https://lists.fedoraproject.org/archives/list/[email protected]/message/6T655QF7CQ3DYAMPFV7IECQYGDEUIVVT/(Mailing List)
- https://lists.fedoraproject.org/archives/list/[email protected]/message/KUQ7CTX3W372X3UY56VVNAHCH6H2F4X3/(Mailing List)
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-4762(Patch, Third Party Advisory)
- https://security.gentoo.org/glsa/202311-11(Third Party Advisory)
- https://security.gentoo.org/glsa/202312-07(Third Party Advisory)
- https://security.gentoo.org/glsa/202401-34(Third Party Advisory)
- https://www.debian.org/security/2023/dsa-5491(Mailing List, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-4762(US Government Resource)
Weakness Type
CWE-843: Access of Resource Using Incompatible Type ('Type Confusion')
CWE-843 describes a weakness where software accesses a resource using an incompatible type, causing the program to operate on that resource as though it were the expected type — often leading to memory corruption, logic errors, or arbitrary code execution. In CVE-2023-4762, Chrome's V8 JavaScript engine contains a type confusion condition that can be triggered by a crafted HTML page, causing V8 to misinterpret the type of a JavaScript object and enabling an attacker to corrupt memory in a controlled manner sufficient to achieve remote code execution.
Learn more: CWE-843 — Access of Resource Using Incompatible Type ('Type Confusion')
Impact Analysis
CVE-2023-4762 carries a CVSS score of 8.8 (HIGH) and is remotely exploitable with no authentication and only a single user interaction — typically visiting a malicious webpage — making it trivially deliverable via phishing, malvertising, or drive-by download scenarios. Confidentiality (High): Full compromise of browser-accessible data is possible, including cookies, saved passwords, web application sessions, and local files accessible to the Chrome process. Integrity (High): An attacker who achieves code execution within Chrome can modify browser state, inject content into web pages, or escalate to a sandbox escape if combined with additional vulnerabilities. Availability (High): Exploitation can cause browser crashes or, following code execution, disrupt system operation depending on the attacker's payload. With confirmed active exploitation and an EPSS score of 54.8% (98.0th percentile), this V8 type confusion vulnerability is a high-urgency threat for any organization or user running an unpatched Chrome or Edge browser.
Exploit Maturity
CVE-2023-4762 is confirmed as actively exploited in the wild by CISA, with a remediation deadline of February 27, 2024 for KEV-listed federal agencies. No ransomware association has been specifically confirmed (KEV ransomware flag: Unknown), but type confusion vulnerabilities in V8 are historically favored by advanced threat actors for browser-based initial access. The EPSS score of 54.8% (98.0th percentile) places this vulnerability among the top 2% most likely to be exploited, which is consistent with CISA's KEV confirmation and the broad attack surface represented by Chrome's global install base. The bug was originally tracked as crbug.com/1473247 (access restricted), and Google released a silent stable channel update on September 11, 2023, indicating the vulnerability was likely disclosed under active exploitation conditions.
Remediation
- Update Google Chrome immediately to version 116.0.5845.179 or later — Google issued the security update via the stable channel and it should be applied as the primary remediation per CISA's required action.
- Update Microsoft Edge (Chromium) to the patched version referenced in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-4762.
- Debian and Fedora Linux users should apply the security updates provided in the respective distribution advisories (DSA-5491 for Debian, package-announce list updates for Fedora).
- Enable automatic updates for Chrome and Edge so future V8 security fixes are applied without delay; verify auto-update is not blocked by enterprise policy.
- Monitor endpoint security solutions for signs of browser exploitation, including unusual Chrome child process spawning, unexpected network connections from browser processes, or sandbox escape indicators.
Technical Details
CVE-2023-4762 is a type confusion vulnerability (CWE-843) in Chrome's V8 JavaScript engine — the component responsible for compiling and executing JavaScript code within the browser. Type confusion occurs when V8 operates on a JavaScript object using an incorrect type assumption, enabling an attacker to craft JavaScript that places a controlled value in memory at a predictable location, which can then be used to corrupt adjacent memory structures or redirect execution flow. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) confirms that the attack is network-delivered, requires no special conditions, no authentication, and only a single user interaction — navigating to a crafted HTML page — to trigger the vulnerability. The scope is unchanged, meaning the impact is contained within the Chrome sandbox unless combined with a sandbox escape. Type confusion vulnerabilities in V8 are particularly dangerous because they can often be exploited reliably across platforms and operating systems wherever Chrome or Chromium-based browsers are deployed.
Frequently Asked Questions
Is CVE-2023-4762 being actively exploited?
Yes. CISA has confirmed CVE-2023-4762 as actively exploited in the wild and included it in the Known Exploited Vulnerabilities catalog with a remediation deadline of February 27, 2024. The EPSS score of 54.8% (98.0th percentile) confirms significant real-world exploitation activity targeting Chrome and Chromium-based browsers.
What products are affected by CVE-2023-4762?
CVE-2023-4762 affects Google Chrome versions prior to 116.0.5845.179, Microsoft Edge (Chromium-based) versions prior to the corresponding patched release, and Debian Linux and Fedora Linux systems running affected Chrome/Chromium packages. Any user or organization running an unpatched version of these browsers is at risk.
How do I fix CVE-2023-4762?
Update Google Chrome to version 116.0.5845.179 or later via the browser's built-in update mechanism or your software deployment tool. Microsoft Edge users should apply the update from the Microsoft Security Response Center. Linux distribution users should apply the OS package manager security updates for the affected Chromium packages. See the Remediation section for full guidance.
How severe is CVE-2023-4762?
CVE-2023-4762 is rated HIGH severity with a CVSS score of 8.8, reflecting its potential for remote code execution requiring only a single user interaction. Its EPSS percentile of 98.0% places it among the most actively exploited browser vulnerabilities, and CISA's KEV listing confirms real-world active exploitation, making immediate patching essential.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.