PT-2023-7689 · Google+4 · V8 Javascript Engine+5
Zhiyi Zhang
·
Publicado
2023-11-14
·
Atualizado
2025-09-29
·
CVE-2023-6702
CVSS v2.0
10
Alta
| Vetor | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Google Chrome versions prior to 120.0.6099.109
Description
The issue is related to a type confusion in the V8 JavaScript engine, which can be exploited by a remote attacker using a specially crafted HTML page, potentially leading to heap corruption or arbitrary code execution. The estimated severity of this issue is high. It has been reported that Google paid out $50,000 in bug bounties related to this and other vulnerabilities.
Recommendations
For Google Chrome versions prior to 120.0.6099.109, update to version 120.0.6099.109 or later to resolve the issue. As a temporary workaround, consider restricting access to potentially vulnerable web pages until the update is applied. Avoid using the
Promise.any function in sensitive contexts until the issue is resolved.Exploit
Correção
Type Confusion
Incorrect Type Conversion or Cast
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Alt Linux
Astra Linux
Google Chrome
Red Os
Suse
V8 Javascript Engine