PT-2023-7689 · Google+4 · V8 Javascript Engine+5
Zhiyi Zhang
·
Published
2023-11-14
·
Updated
2025-09-29
·
CVE-2023-6702
CVSS v2.0
10
High
| Vector | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Google Chrome versions prior to 120.0.6099.109
Description
The issue is related to a type confusion in the V8 JavaScript engine, which can be exploited by a remote attacker using a specially crafted HTML page, potentially leading to heap corruption or arbitrary code execution. The estimated severity of this issue is high. It has been reported that Google paid out $50,000 in bug bounties related to this and other vulnerabilities.
Recommendations
For Google Chrome versions prior to 120.0.6099.109, update to version 120.0.6099.109 or later to resolve the issue. As a temporary workaround, consider restricting access to potentially vulnerable web pages until the update is applied. Avoid using the
Promise.any function in sensitive contexts until the issue is resolved.Exploit
Fix
Type Confusion
Incorrect Type Conversion or Cast
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Google Chrome
Red Os
Suse
V8 Javascript Engine