CVE-2023-7024
Google Chromium WebRTC Heap Buffer Overflow Vulnerability
Description
CVE-2023-7024 is a heap buffer overflow vulnerability in the WebRTC component of Google Chrome, present in versions prior to 120.0.6099.129. This type of memory corruption flaw, classified as CWE-787 (Out-of-bounds Write), allows a remote attacker to potentially exploit heap corruption by tricking a victim into visiting a specially crafted HTML page. Successful exploitation could grant an attacker high-level access to confidentiality, integrity, and availability of the affected system. CVE-2023-7024 has been added to the CISA Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild, and carries an EPSS score of approximately 2.9%, placing it in the 86th percentile of likely-exploited vulnerabilities.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| chrome | < 120.0.6099.129 | |
| debian | debian linux | 11.0; 12.0 |
| fedoraproject | fedora | 38; 39 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://chromereleases.googleblog.com/2023/12/stable-channel-update-for-desktop_20.html(Vendor Advisory)
- https://crbug.com/1513170(Exploit, Issue Tracking)
- https://lists.fedoraproject.org/archives/list/[email protected]/message/6M6AJDHUL6EDPURWQXGLUFJNDE7SOJT3/(Broken Link, Mailing List)
- https://lists.fedoraproject.org/archives/list/[email protected]/message/U6JL4VHZMHFGEGQYTF74533ZNRWMCMMR/(Broken Link, Mailing List)
- https://security.gentoo.org/glsa/202401-34(Third Party Advisory)
- https://www.debian.org/security/2023/dsa-5585(Mailing List)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-7024(US Government Resource)
Weakness Type
CWE-787: Out-of-bounds Write
CVE-2023-7024 is caused by an out-of-bounds write weakness in Chrome’s WebRTC implementation. When processing certain crafted HTML content, the WebRTC engine writes data beyond the bounds of an allocated heap buffer, potentially corrupting adjacent memory structures and enabling arbitrary code execution.
Learn more: CWE-787 — Out-of-bounds Write
Impact Analysis
CVE-2023-7024 carries a CVSS v3.1 base score of 8.8 (HIGH). The attack vector is Network, meaning exploitation does not require local access. Attack complexity is Low and no privileges are required, though user interaction is required — the victim must visit a crafted web page.
Confidentiality Impact: High — An attacker can read sensitive data from the Chrome process memory.
Integrity Impact: High — Successful exploitation can allow writing arbitrary data, altering browser state or executing injected code.
Availability Impact: High — The vulnerability can cause the browser to crash or become unresponsive.
Because this vulnerability was actively exploited in the wild (confirmed by CISA KEV listing), the real-world risk is significantly elevated for organizations and individuals who had not patched by the KEV due date of January 23, 2024.
Exploit Maturity
CVE-2023-7024 has been confirmed as actively exploited in the wild, as evidenced by its inclusion in the CISA Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of January 23, 2024. The EPSS score of 0.029 (86th percentile) reflects meaningful real-world exploitation probability. A Chromium bug tracker issue (crbug.com/1513170) has been referenced in relation to this vulnerability, and exploit activity was notable enough to prompt an emergency stable channel update from Google in December 2023. Ransomware association is listed as Unknown.
Remediation
- Update Google Chrome immediately to version 120.0.6099.129 or later. Google released an emergency stable channel update on December 20, 2023, specifically addressing this vulnerability.
- Enable automatic updates in Chrome (Settings > About Google Chrome) to ensure future security patches are applied without delay.
- Update Chromium-based browsers — Other browsers built on the Chromium engine (e.g., Edge, Brave, Opera) may be similarly affected. Check for and apply updates from their respective vendors.
- Update Debian and Fedora packages — If running Chrome or Chromium via Linux package managers, apply the security updates provided via DSA-5585 (Debian) and the Fedora security notices.
- Apply mitigations per vendor instructions or discontinue use if updates are unavailable, as required by the CISA KEV catalog.
Technical Details
CVE-2023-7024 is a heap buffer overflow (CWE-787, Out-of-bounds Write) in Chrome’s WebRTC subsystem — the component responsible for real-time audio, video, and data communication within the browser.
Attack vector: The vulnerability is triggered via a specially crafted HTML page delivered over the network. No special privileges or pre-existing authentication are required from the attacker side; however, user interaction (visiting the malicious page) is necessary.
Memory corruption mechanism: WebRTC processing of certain media or data channel content causes the engine to write beyond the bounds of a heap-allocated buffer. This out-of-bounds write can corrupt adjacent heap memory, potentially allowing an attacker to redirect code execution or leak memory contents.
Scope: The CVSS scope is Unchanged, meaning exploitation is contained within the Chrome browser process. However, given the high impact across all three pillars (C/I/A), a successful exploit could enable full browser compromise.
Affected versions: Google Chrome prior to 120.0.6099.129. Debian Linux and Fedora Linux distributions shipping affected Chromium packages were also impacted until upstream patches were applied.
Frequently Asked Questions
What is CVE-2023-7024?
CVE-2023-7024 is a heap buffer overflow vulnerability in the WebRTC component of Google Chrome (versions before 120.0.6099.129). It allows a remote attacker to potentially execute arbitrary code by luring a user to a malicious web page.
Is CVE-2023-7024 being actively exploited?
Yes. CISA added CVE-2023-7024 to its Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of January 23, 2024, confirming active exploitation in the wild at the time of disclosure.
Which products are affected by CVE-2023-7024?
Google Chrome versions prior to 120.0.6099.129 are directly affected. Downstream packages for Debian Linux and Fedora Linux distributing Chromium were also vulnerable until patched versions were released by those distributions.
How can I protect myself from CVE-2023-7024?
Update Google Chrome to version 120.0.6099.129 or later immediately. Enable automatic updates to ensure future patches are applied promptly. If using Chromium on Linux, apply the relevant distribution security update (e.g., DSA-5585 for Debian).
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.