CVE-2023-2313

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Inappropriate implementation in Sandbox in Google Chrome on Windows prior to 112.0.5615.49 allowed a remote attacker who had compromised the renderer process to perform arbitrary read/write via a malicious file. (Chromium security severity: High)

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
Google	Chrome	>= 112.0.5615.49, < 112.0.5615.49

References

https://chromereleases.googleblog.com/2023/04/stable-channel-update-for-desktop.htmlRelease Notes, Vendor Advisory
https://crbug.com/1335974Exploit, Issue Tracking, Vendor Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2LE64KGGOISKPKMYROSDT4K6QFVDIRF6/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/B6SAST6CB5KKCQKH75ER2UQ3ICYPHCIZ/
https://chromereleases.googleblog.com/2023/04/stable-channel-update-for-desktop.htmlRelease Notes, Vendor Advisory
https://crbug.com/1335974Exploit, Issue Tracking, Vendor Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2LE64KGGOISKPKMYROSDT4K6QFVDIRF6/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/B6SAST6CB5KKCQKH75ER2UQ3ICYPHCIZ/

Timeline

Published: Jul 29, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-231305.9Connectwise Automate 2022.11 is vulnerable to Cleartext authentication. Authentication is being done via HTTP (cleartext) with SSL disabled.CVE-2023-231317.5Selfwealth iOS mobile App 3.3.1 is vulnerable to Insecure App Transport Security (ATS) Settings.CVE-2023-231327.5Selfwealth iOS mobile App 3.3.1 is vulnerable to Sensitive key disclosure. The application reveals hardcoded API keys.CVE-2023-231357.2An arbitrary file upload vulnerability in Ftdms v3.1.6 allows attackers to execute arbitrary code via uploading a crafted JPG file.CVE-2023-231366.5lmxcms v1.41 was discovered to contain an arbitrary file deletion vulnerability via BackdbAction.class.php.CVE-2023-23146.5Insufficient data validation in DevTools in Google Chrome prior to 111.0.5563.64 allowed a remote attacker to bypass navigation restrictions CVE-2023-231437.8Buffer overflow vulnerability in function avc_parse_slice in file media_tools/av_parsers.c. GPAC version 2.3-DEV-rev1-g4669ba229-master.CVE-2023-231445.5Integer overflow vulnerability in function Q_DecCoordOnUnitSphere file bifs/unquantize.c in GPAC version 2.2-rev0-gab012bbfb-master.CVE-2023-231457.8GPAC version 2.2-rev0-gab012bbfb-master was discovered to contain a memory leak in lsr_read_rare_full function.CVE-2023-231499.8DEK-1705 <=Firmware:34.23.1 device was discovered to have a command execution vulnerability.CVE-2023-23158.8Path Traversal in OpenCart versions 4.0.0.0 to 4.0.2.2 allows an authenticated user with access/modify privilege on the Log component to emp CVE-2023-231509.8SA-WR915ND router firmware v17.35.1 was discovered to be vulnerable to code execution.