CVE-2023-5997

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Use after free in Garbage Collection in Google Chrome prior to 119.0.6045.159 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

Vendor	Product	Versions
Google	Chrome	>= 119.0.6045.159, < 119.0.6045.159

References

https://chromereleases.googleblog.com/2023/11/stable-channel-update-for-desktop_14.htmlRelease Notes, Vendor Advisory
https://crbug.com/1497997Permissions Required
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JHUI5HW7QXT3U74MJMTLUMF5REDO5HD5/Mailing List
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MN3JQGEC4EFQP3WTI33YBD3CLC3I7P4X/Mailing List
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XWHRLW3GDNFBFSBHDD4QOPUPX7ORTUEC/Mailing List
https://security.gentoo.org/glsa/202311-11Third Party Advisory
https://security.gentoo.org/glsa/202312-07Third Party Advisory
https://security.gentoo.org/glsa/202401-34
https://www.debian.org/security/2023/dsa-5556Third Party Advisory
https://chromereleases.googleblog.com/2023/11/stable-channel-update-for-desktop_14.htmlRelease Notes, Vendor Advisory
https://crbug.com/1497997Permissions Required
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JHUI5HW7QXT3U74MJMTLUMF5REDO5HD5/Mailing List
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MN3JQGEC4EFQP3WTI33YBD3CLC3I7P4X/Mailing List
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XWHRLW3GDNFBFSBHDD4QOPUPX7ORTUEC/Mailing List
https://security.gentoo.org/glsa/202311-11Third Party Advisory
https://security.gentoo.org/glsa/202312-07Third Party Advisory
https://security.gentoo.org/glsa/202401-34
https://www.debian.org/security/2023/dsa-5556Third Party Advisory

Timeline

Published: Nov 15, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-59987.5Out-of-bounds Read in GitHub repository gpac/gpac prior to 2.3.0-DEV.CVE-2023-60006.1The Popup Builder WordPress plugin before 4.2.3 does not prevent simple visitors from updating existing popups, and injecting raw JavaScript CVE-2023-60017.5Prometheus metrics are available without authentication. These expose detailed and sensitive information about the YugabyteDB Anywhere envir CVE-2023-60026.1YugabyteDB is vulnerable to cross site scripting (XSS) via log injection. Writing invalidated user input to log files can allow an unprivile CVE-2023-60044.8A flaw was found in libssh. By utilizing the ProxyCommand or ProxyJump feature, users can exploit unchecked hostname syntax on the client. T CVE-2023-60054.8The EventON WordPress plugin before 4.5.5, EventON WordPress plugin before 2.2.7 does not sanitize and escape some of its settings, which co CVE-2023-60066.7This vulnerability potentially allows local attackers to escalate privileges on affected installations of PaperCut NG. An attacker must have CVE-2023-60076.5The UserPro plugin for WordPress is vulnerable to unauthorized access of data, modification of data, loss of data due to a missing capabilit CVE-2023-60084.3The UserPro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.1.1. This is due to missing CVE-2023-60098.8The UserPro plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.1.4 due to insufficient restricti CVE-2023-60115.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DECE Software Geodi allows Stored XSS.CVE-2023-60129.8An improper input validation vulnerability has been found in Lanaccess ONSAFE MonitorHM affecting version 3.7.0. This vulnerability could le