CVE-2023-7024: Google Chromium WebRTC Heap Buffer Overflow Vulnerability
CVE-2023-7024 · Severity: critical · CVSS 8.8 · Exploited in the wild · Published 2024-01-02
A heap buffer overflow vulnerability exists in the WebRTC component of Google Chromium-based browsers. A remote attacker can trigger heap corruption by enticing a user to visit a specially crafted HTML page, potentially leading to arbitrary code execution.
Yes. CVE-2023-7024 is known to be exploited in the wild, first recorded on 2 January 2024. Treat it as urgent.
How severe is CVE-2023-7024?
Critical severity, with a CVSS score of 8.8, published 2 January 2024.
Which products and versions are affected?
Google Chrome prior to 120.0.6099.129; Google Chromium WebRTC.
Is there a fix for CVE-2023-7024?
A patch was published on 2023-12-20: Stable channel update for desktop released (120.0.6099.129) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2023-7024 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2023-7024?
Check whether you run Google Chromium WebRTC. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Affected products
Google Chrome prior to 120.0.6099.129
Google Chromium WebRTC
Timeline
2023-12-20: patched: Stable channel update for desktop released (120.0.6099.129)
2024-01-02: disclosed: CVE published and added to CISA KEV catalog
2024-01-02: kev added: Added to CISA Known Exploited Vulnerabilities Catalog
2024-01-02: exploited: Reported as exploited in the wild in the advisory and CISA KEV catalog.