CVE-2023-0129 - Heap buffer overflow in Network Service in Google Chrome prior to 109.0.5414.74 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page and specific interactions

Back Back to CVE browser

HIGH

Heap buffer overflow in Network Service in Google Chrome prior to 109.0.5414.74 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page and specific interactions

Published Jan 10, 2023

8.8

HIGH

CVSS 3.1

EPSS 0.50%

Description

Heap buffer overflow in Network Service in Google Chrome prior to 109.0.5414.74 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page and specific interactions. (Chromium security severity: High)

Affected products

Vendor Google Product Chrome Default
unknown
Affected
- ≥ unspecified, < 109.0.5414.74

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Google	Chrome	unknown	Affected ≥ unspecified, < 109.0.5414.74

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-787

Out-of-bounds Write

References (5)

https://chromereleases.googleblog.com/2023/01/stable-channel-update-for-desktop.html
Release NotesVendor Advisory
https://crbug.com/1382033
Permissions Required
https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-12219
Advisory
https://security.gentoo.org/glsa/202305-10
vendor-advisory
https://security.gentoo.org/glsa/202311-11
vendor-advisory

Link	Providers	Tags
https://chromereleases.googleblog.com/2023/01/stable-channel-update-for-desktop.html		Release NotesVendor Advisory
https://crbug.com/1382033		Permissions Required
https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-12219		Advisory
https://security.gentoo.org/glsa/202305-10		vendor-advisory
https://security.gentoo.org/glsa/202311-11		vendor-advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner Chrome

Published Jan 10, 2023

Updated May 5, 2025

Reserved Jan 9, 2023

Link CVE-2023-0129

CISA Vulnrichment

Updated Apr 23, 2025

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2023-0129

Red Hat

No data

ENISA EUVD

Assigner Chrome

Published Jan 10, 2023

Updated May 5, 2025

Link EUVD-2023-12219

GitHub

No data