CVE-2023-3079: Google Chrome V8 type confusion enables heap corruption

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityThe flaw is in KEV with a high EPSS score and high CVSS impact, but exploitation requires a victim to load a crafted page, so it is high rather than critical.

What it is

CVE-2023-3079 is a type confusion flaw in the V8 JavaScript engine in Google Chrome before 114.0.5735.110. A crafted HTML page can trigger the confusion and potentially corrupt the heap, and the issue was serious enough for CISA to add it to the Known Exploited Vulnerabilities catalog.

Impact

An attacker who gets a victim to load a malicious page can potentially achieve heap corruption, which can lead to code execution or a browser crash in the renderer process. The CVSS vector rates confidentiality, integrity and availability impact as high.

Attack surface

Reached over the network by a victim visiting or being redirected to a crafted HTML page; no authentication is required, but user interaction (loading the page) is needed per the CVSS vector. The flaw is in the V8 engine, so any Chromium-based browsing context that renders the page is in scope.

Exploitation

CISA added this to KEV on 2023-06-07 with a 2023-06-28 remediation due date, and EPSS gives a 30-day probability of 0.3211 (98.2nd percentile), indicating observed exploitation. Reference tags include Exploit and third-party advisories describing a sandbox escape, but the record does not state which specific threat actors used it.

What to do

• Update Google Chrome to 114.0.5735.110 or later, and apply the corresponding Chromium updates in any embedded browser or Electron-style runtime.
• Apply the vendor updates for the listed downstream products (Fedora, Debian, Gentoo, macOS, Linux kernel, Couchbase Server) that bundle or depend on the affected Chromium/V8 code.
• Prioritize patching internet-facing and user-facing browser endpoints first, since exploitation requires only that a user load a crafted page.
• If immediate patching is not possible, restrict browsing to trusted sites and enforce script controls or an isolated browsing environment for high-risk users.
• Track the KEV due date (2023-06-28) and confirm remediation across all managed endpoints and containers.

Detection

• Hunt for Chrome or Chromium processes crashing repeatedly with heap corruption or access-violation faults in V8, especially following visits to untrusted sites.
• Monitor proxy, DNS and browser telemetry for requests to known exploit-hosting or malvertising domains and correlate with browser version data.
• Inventory endpoints and containers for Chrome/Chromium versions below 114.0.5735.110 and for downstream packages carrying the vulnerable V8 code.
• Review EDR alerts for browser child processes spawning unexpected executables, which can indicate post-exploitation activity after a renderer compromise.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.