CVE-2023-1220 — Out-of-bounds Write in Google Chrome

CWE-787 — Out-of-bounds WriteCWE-1220 — Insufficient Granularity of Access ControlCWE-863 — Incorrect AuthorizationCWE-200 — Sensitive Information Exposure19 documents9 sources
Severity
8.8HIGHNVD
GHSA8.1
EPSS
0.2%
top 58.66%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
20
Google ChromeChromiumMiniflux.app V2+17 more
Timeline
PublishedMar 7
Latest updateSep 16

Description

Heap buffer overflow in UMA in Google Chrome prior to 111.0.5563.64 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages21 packages

▶CVEListV5google/chrome111.0.5563.64 — 111.0.5563.64
▶NVDgoogle/chrome< 111.0.5563.64
▶debiandebian/chromium< chromium 111.0.5563.64-1 (bookworm)
▶Debianchromium/chromium< 111.0.5563.64-1~deb11u1+3

🔴Vulnerability Details

7
GHSA
Unauthenticated Miniflux user can bypass allowed networks check to obtain Prometheus metrics↗2025-04-02
▶
GHSA
aimeos/ai-admin-graphql improper access control vulnerability allows an editor to modify admin account↗2024-07-02
▶
GHSA
aimeos/ai-admin-graphql improper access control vulnerability allows editors to manage own services↗2024-07-02
▶
GHSA
Microsoft Security Advisory CVE-2023-33127: .NET Remote Code Execution Vulnerability↗2023-07-11
▶
OSV
chromium-browser vulnerabilities↗2023-03-13
▶

📋Vendor Advisories

11
Red Hat
kernel: wifi: mac80211_hwsim: drop short frames↗2025-09-16
▶
Microsoft
IBM Spectrum Fusion HCI improper access control↗2024-05-14
▶
Red Hat
tripleo-ansible: bind keys are world readable↗2024-03-15
▶
Red Hat
open-vm-tools: SAML token signature bypass↗2023-10-26
▶
Red Hat
openshift-logging: LokiStack authorisation is cached too broadly↗2023-08-21
▶