CVE-2023-3731

HighCVSS 8.8

Published: 01/08/2023(UTC)Updated: 17/06/2026(UTC)Translated: 18/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.32%

24th percentile - higher than 24% of all known CVEs

Summary

Use after free in Diagnostics in Google Chrome on ChromeOS prior to version 115.0.5790.131 allows an attacker who convinces a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension.

Risk Assessment

This vulnerability poses a high risk to organizations as it could lead to serious security breaches if users install malicious extensions.

Recommendation

It is recommended to update Google Chrome on ChromeOS to the latest version to mitigate this vulnerability and to educate users about the risks of installing unknown extensions.

Other vulnerabilities in Google Chrome on ChromeOS

CVE-2023-4369High
Insufficient data validation in Systems Extensions in Google Chrome on ChromeOS prior to version 116.0.5845.120 allowed an attacker who convinced a user to install a malicious extension to bypass file restrictions via a crafted HTML page.

Original NVD description (English source)

Use after free in Diagnostics in Google Chrome on ChromeOS prior to 115.0.5790.131 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension. (Chromium security severity: High)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS