Vulnerability record · CVE-2023-3420 · published 26 June 2023
CVE-2023-3420: Google Chrome V8 type confusion allows heap corruption
Google · Chrome
Google Chrome before 114.0.5735.198 contains a type confusion flaw in the V8 JavaScript engine. A crafted HTML page can trigger the confusion and potentially corrupt the heap, which matters because Chrome is widely deployed and the flaw is remotely reachable.
Description
Type Confusion in V8 in Google Chrome prior to 114.0.5735.198 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Automated analysis
high priorityRemote, unauthenticated-reachability with user interaction, high CVSS impact and very high EPSS make this a high-priority browser patch despite no KEV listing.
What it is
Google Chrome before 114.0.5735.198 contains a type confusion flaw in the V8 JavaScript engine. A crafted HTML page can trigger the confusion and potentially corrupt the heap, which matters because Chrome is widely deployed and the flaw is remotely reachable.
Impact
An attacker who gets the page rendered may achieve heap corruption, which can lead to code execution or a crash in the browser process. The CVSS vector rates confidentiality, integrity and availability impact as high.
Attack surface
Reached over the network by loading a crafted HTML page in Chrome; no privileges are required but user interaction (visiting or rendering the page) is needed per the CVSS vector. The crbug reference is marked permissions required, so technical detail is restricted.
Exploitation
Not listed in CISA KEV and no ransomware association is documented, but EPSS is 0.56192 (99th percentile), indicating high predicted exploitation likelihood. References are vendor advisories and distro updates, with no public exploit tag.
What to do
- Update Chrome to 114.0.5735.198 or later, and apply the corresponding Debian, Fedora and Gentoo updates.
- Enforce automatic browser updates and verify version compliance across endpoints.
- Restrict or sandbox browsing of untrusted content where feasible, and keep the renderer sandbox enabled.
- Track the vendor advisory and distro security notices for any follow-up fixes.
Detection
- Monitor for Chrome renderer crashes or abnormal process termination that could indicate heap corruption attempts.
- Alert on Chrome versions below 114.0.5735.198 in asset inventories.
- Review proxy or DNS logs for delivery of suspicious HTML pages to browsers, correlated with crash telemetry.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2023-3420 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2023-3420), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
