Google Chrome

CVE-2023-5217

HIGH 8.8CISA KEV ↗Exploited per ENISA since 2023-10-02

At a glance

Source: NVD
EPSS: EPSS 49.01 % · percentile 99 (2026-10-31)
State: PUBLISHED
Published: 2023-09-28 15:23 UTC
Updated: 2025-10-21 23:05 UTC
Assigner: Chrome
NVD status: Analyzed

Search on…

Description

Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Weaknesses (CWE)

CWE-787 — Out-of-bounds Write

References

Scores

Version	Score	Vector	Scored by
CVSS 3.1	HIGH 8.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	CISA-ADP
CVSS 3.1	HIGH 8.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	NVD · nvd@nist.gov (Primary)
CVSS 3.1	HIGH 8.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Advisories

GHSA-qqvq-6xgj-jw8g — Electron affected by libvpx's heap buffer overflow in vp8 encoding

European references

ENISA EUVD · EUVD-2023-2578
GCVE · GCVE-0-2023-5217

CERT-FR advisories

CERTFR-2025-AVI-0565 — Multiples vulnérabilités dans les produits Schneider Electric · cert.ssi.gouv.fr
CERTFR-2025-AVI-0031 — Multiples vulnérabilités dans les produits Fortinet · cert.ssi.gouv.fr
CERTFR-2024-AVI-0209 — Multiples vulnérabilités dans les produits SAP · cert.ssi.gouv.fr
CERTFR-2023-AVI-0838 — Multiples vulnérabilités dans les produits Apple · cert.ssi.gouv.fr
CERTFR-2023-AVI-0820 — Multiples vulnérabilités dans les produits ElasticSearch · cert.ssi.gouv.fr
CERTFR-2023-AVI-0806 — Multiples vulnérabilités dans les produits Apple · cert.ssi.gouv.fr
CERTFR-2023-AVI-0797 — Multiples vulnérabilités dans Microsoft Edge · cert.ssi.gouv.fr
CERTFR-2023-AVI-0796 — Vulnérabilité dans Mozilla Thunderbird · cert.ssi.gouv.fr
CERTFR-2023-AVI-0794 — Vulnérabilité dans Mozilla Firefox · cert.ssi.gouv.fr
CERTFR-2023-AVI-0787 — Multiples vulnérabilités dans Google Chrome · cert.ssi.gouv.fr

Affected configurations (NVD CPE)

cpe:2.3:a:webmproject:libvpx:*:*:*:*:*:*:*:* < 1.13.1
cpe:2.3:a:microsoft:edge:116.0.1938.98:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:edge:117.0.2045.47:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:edge_chromium:116.0.5845.229:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:edge_chromium:117.0.5938.132:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:* < 115.3.1
cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:* < 118.0.1
cpe:2.3:a:mozilla:firefox:*:*:*:*:*:android:*:* < 118.1
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:* < 115.3.1
cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*
cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:* ≥ 17.0 < 17.0.3
cpe:2.3:o:apple:ipados:16.7:*:*:*:*:*:*:*
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:* ≥ 17.0 < 17.0.3
cpe:2.3:o:apple:iphone_os:16.7:*:*:*:*:*:*:*
cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* < 117.0.5938.132
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*

Affected products

Product	Versions
Google · Chrome	affected 117.0.5938.132 < 117.0.5938.132
Google · libvpx	affected 1.13.1 < 1.13.1

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
CISA Known Exploited Vulnerabilities	CC0 1.0
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD

⚠️ Google Chrome