{"id":"CVE-2023-3079","kind":"vulnerability","aliases":["CVE-2023-3079"],"related":[],"title":"Type confusion in V8 in Google Chrome prior to 114.0.5735.110 allowed a remote attacker to potentially exploit heap…","description":"Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.\n\nCISA required action: Apply updates per vendor instructions.","summary":"A type confusion bug in the V8 JavaScript engine used by Chromium lets a remote attacker corrupt heap memory with a crafted HTML page. Exploitation in the wild is confirmed by CISA's KEV catalog, and an attacker can use it to run code in the browser.","severity":"high","cvss":8.8,"epss":null,"exploited":true,"exploited_at":"2023-06-07T00:00:00+00:00","products":[{"name":"Google Chromium V8","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"google chrome","fixed":["114.0.5735.110"],"affected":"< 114.0.5735.110","ecosystem":"vendor"},{"name":"fedoraproject fedora","fixed":[],"affected":"= 37","ecosystem":"vendor"},{"name":"fedoraproject fedora","fixed":[],"affected":"= 38","ecosystem":"vendor"},{"name":"debian linux","fixed":[],"affected":"= 11.0","ecosystem":"vendor"},{"name":"debian linux","fixed":[],"affected":"= 12.0","ecosystem":"vendor"},{"name":"couchbase server","fixed":["7.1.5"],"affected":"< 7.1.5","ecosystem":"vendor"},{"name":"couchbase server","fixed":[],"affected":"= 7.2.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["browsers","chromium","exploited","google-chrome","microsoft-edge","opera","runtime"],"not_affected_if":["already-patched-browser"],"how_to_check":"Open the browser's version page (chrome://version or edge://version) and compare the version to the fixed release in the vendor advisory.","fix":"Update Google Chrome, Microsoft Edge, Opera or other Chromium-based browsers to the patched release named in the vendor advisory.","status":"open","published_at":"2023-06-05T22:15:12+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T21:06:36+00:00","updated_at":"2026-10-23T22:29:04+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-10-23T21:06:36Z","model":"claude-haiku-5-5","output":{"fix":"Update Google Chrome, Microsoft Edge, Opera or other Chromium-based browsers to the patched release named in the vendor advisory.\nunknown","reach":"internet","impact":"high","summary":"A type confusion bug in the V8 JavaScript engine used by Chromium lets a remote attacker corrupt heap memory with a crafted HTML page. Exploitation in the wild is confirmed by CISA's KEV catalog, and an attacker can use it to run code in the browser.","category":"runtime","who_cares":["chromium","google-chrome","microsoft-edge","opera","browsers"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker runs code in the browser after the victim opens a crafted page.","analyst_note":"Fixed browser version numbers are not in the sources; check the Chrome Releases blog and the CISA KEV entry for CVE-2023-3079 to confirm the patched version.","how_to_check":"Open the browser's version page (chrome://version or edge://version) and compare the version to the fixed release in the vendor advisory.\nunknown\nunknown","needs_analyst":true,"not_affected_if":["already-patched-browser"],"user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000507,"input_tokens":2847,"output_tokens":445,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2023':20A,23A '-3079':21A,24A '114.0.5735.110':10A 'action':147C 'affect':127C 'allow':11A,110C 'appli':148C 'attack':14A,68B,90B,113C 'browser':42B,99B,130C 'bug':56B 'catalog':87B 'chrome':7A,29A,47B,140C 'chromium':26A,43B,64B,101C,133C 'cisa':84B,145C 'code':96B 'confirm':82B 'confus':2A,55B,107C 'contain':104C 'corrupt':69B,118C 'couchbase':38A,40A 'could':126C 'craft':74B,121C 'cve':19A,22A 'debian':34A,36A 'edg':50B,142C 'engin':61B,103C 'exploit':17A,44B,77B,116C 'fedora':31A,33A 'fedoraproject':30A,32A 'googl':6A,46B,100C,139C 'google':25A,28A 'google-chrom':45B 'heap':18A,70B,117C 'html':75B,122C 'includ':134C 'instruct':152C 'javascript':60B 'kev':86B 'let':65B 'limit':137C 'linux':35A,37A 'memori':71B 'microsoft':49B,141C 'microsoft-edg':48B 'multipl':128C 'opera':51B,144C 'page':76B,123C 'per':150C 'potenti':16A,115C 'prior':8A 'remot':13A,67B,112C 'requir':146C 'run':95B 'runtim':52B 'server':39A,41A 'type':1A,54B,106C 'updat':149C 'use':62B,92B 'util':132C 'v8':4A,27A,59B,102C 'vendor':151C 'via':119C 'vulner':108C,125C 'web':129C 'wild':80B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2023-06-05T22:15:12+00:00","kev":{"dateAdded":"2023-06-07","dueDate":"2023-06-28","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2023-3079","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-3079","severity":null,"published_at":"2023-06-07T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T20:35:34+00:00","note":null},{"source":"nvd","external_id":"CVE-2023-3079","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-3079","severity":null,"published_at":"2023-06-05T22:15:12+00:00","modified_at":"2026-10-08T18:04:20+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}