CVE-2023-3497 — Out-of-bounds Read in Google Chrome

CWE-125 — Out-of-bounds Read3 documents3 sources
Severity
4.6MEDIUMNVD
EPSS
0.0%
top 94.38%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Google ChromeGoogle Chrome Chrome
Timeline
PublishedJul 3
Latest updateJul 20

Description

Out of bounds read in Google Security Processor firmware in Google Chrome on Chrome OS prior to 114.0.5735.90 allowed a local attacker to perform denial of service via physical access to the device. (Chromium security severity: Medium)

CVSS vector

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 0.9 | Impact: 3.6

Affected Packages3 packages

▶CVEListV5google/chrome114.0.5735.90 — 114.0.5735.90
▶NVDgoogle/chrome< 114.0.5735.90

🔴Vulnerability Details

1
GHSA
GHSA-x288-jvvj-q522: Out of bounds read in Google Security Processor firmware in Google Chrome on Chrome OS prior to 114↗2023-07-03
▶

📋Vendor Advisories

1
Chrome
Stable Channel Update for ChromeOS / ChromeOS Flex: CVE-2023-3497↗2023-07-20
▶