CVE-2023-2033: Google Chromium V8 Type Confusion Vulnerability
Vulnerability summary
CVE-2023-2033 is a high (CVSS 8.8) Type Confusion vulnerability in Google Chromium V8. It is known to be exploited: CISA lists it, first on 17-04-2023. EPSS estimates a 40.80% chance of exploitation in the next 30 days, higher than 98.6% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 5 · Related 5Timeline
- 14-04-2023PublishedVulnerability first disclosed.
- 17-04-2023Added to CISA KEVGoogle Chromium V8 Type Confusion Vulnerability
- 08-05-2023CISA remediation dueApply updates per vendor instructions.
- 21-10-2025Last modifiedVulnerability information updated.
Description
Type confusion in V8 in Google Chrome prior to 112.0.5615.121 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS metrics
3 scores · 3 sources · 1 version- OSV · DebianEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- NVDNIST8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS trend
Probability
40.80%
Chance of exploitation in the next 30 days
Percentile
99%
Versus all other CVEs
30-day change
0.00 pp
From 40.80% on 20-09-2026
Known exploited
Compare KEV catalogs
CISA KEVListed- Added
- 17-04-2023
- Federal due date
- 08-05-2023
CISA required action
Apply updates per vendor instructions. chromereleases.googleblog.com/2023/04/stable-channel-update-for-desktop_14.html nvd.nist.gov/vuln/detail/CVE-2023-2033
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Debian2 products
- chromium< 112.0.5615.121-1 | < 112.0.5615.121-1~deb11u1
- debian_linuxEOL11.0
Couchbase1 product
- couchbase_serverEOL< 7.1.5 | 7.2.0
Fedoraproject1 product
- fedoraEOL36 | 37 | 38
Google1 product
- chrome≥ 112.0.5615.121, < 112.0.5615.121 | < 112.0.5615.121
Opensuse1 product
- chromium&distro=openSUSE Tumbleweed< 112.0.5615.121-1.1
5 vendors · 6 products
References
14 links- chromereleases.googleblog.com/2023/04/stable-channel-update-for-desktop_14.htmlRelease NotesVendor Advisory
- crbug.com/1432210Permissions Required
- www.couchbase.com/alerts/Third Party Advisory
www.debian.org/security/2023/dsa-5390Third Party Advisory- lists.fedoraproject.org/archives/…Mailing List
- lists.fedoraproject.org/archives/…Mailing List
- lists.fedoraproject.org/archives/…Mailing List
- lists.fedoraproject.org/archives/…Mailing List
- lists.fedoraproject.org/archives/…Mailing List
- lists.fedoraproject.org/archives/…Mailing List
Show all 14 references
- security.gentoo.org/glsa/202309-17Third Party Advisory
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-2033Government ResourceUS Government Resource