Actively exploited in the wild
Google Chromium WebRTC Heap Buffer Overflow Vulnerability
Google - Chromium WebRTC · Listed in the CISA KEV since 2024-01-02. This indicates confirmed attacks in production environments.
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CVE-2023-7024
HighCVSS 8.8KEVSummary
Heap buffer overflow in WebRTC in Google Chrome prior to 120.0.6099.129 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Risk Assessment
Chrome users could be attacked by visiting a malicious page, potentially leading to arbitrary code execution.
Recommendation
Update Google Chrome to version 120.0.6099.129 or later.
Other vulnerabilities in Google Chrome
See all- CVE-2026-93387Unknown
Improper state validation in Skia in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. The vulnerability was rated High severity by Chromium.
- CVE-2026-93386Unknown
UI misrepresentation in WebAppInstalls in Google Chrome prior to 153.0.8010.52 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. The vulnerability was rated Low severity by Chromium.
- CVE-2026-93385Unknown
Information leak in Paint in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to obtain sensitive information via a crafted HTML page. The vulnerability was rated Medium severity by Chromium.
- CVE-2026-93384Unknown
Server-side request forgery in Omnibox in Google Chrome on Android prior to 153.0.8010.52 allowed a remote attacker leveraging social engineering to bypass system access restrictions via crafted network traffic. The vulnerability was rated Medium severity by Chromium.
- CVE-2026-93383Unknown
Information leak in Permissions in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to leak cross-origin data via a crafted HTML page. The vulnerability was rated Medium severity by Chromium.
- CVE-2026-93382Unknown
Use after free in PDFium in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. The vulnerability was rated High severity by Chromium.
- CVE-2026-93381Unknown
Buffer overflow in PDFium in Google Chrome on Windows prior to 153.0.8010.52 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code inside the sandbox via a crafted PDF file. The vulnerability was rated High severity by Chromium.
- CVE-2026-93380Unknown
Race condition in FileSystem in Google Chrome prior to 153.0.8010.52 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass system access restrictions via a crafted HTML page. The vulnerability was rated Medium severity by Chromium.
- CVE-2026-93379Unknown
Incorrect authorization in ORB in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to bypass site isolation via a crafted HTML page. The vulnerability was rated High severity by Chromium.
- CVE-2026-93378Unknown
Missing authorization in Storage in Google Chrome prior to 153.0.8010.52 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted PDF file. The vulnerability was rated Medium severity by Chromium.
Original NVD description (English source)
Heap buffer overflow in WebRTC in Google Chrome prior to 120.0.6099.129 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)