CVE-2023-4762

CVE-2023-4762 is a type confusion bug (CWE-843) in the V8 JavaScript engine used by Google Chromium, allowing a remote attacker to execute arbitrary code in the context of the browser when a user visits or is redirected to a crafted HTML page. Because V8 is shared across Chromium-based browsers, the flaw affects Google Chrome, Microsoft Edge, Opera, and other Chromium derivatives, not just Chrome itself. Successful exploitation gives an attacker code execution within the browser process on the victim's machine, a common foothold for delivering further malware. Google patched the bug in Chrome 116.0.5845.179/.180 (September 2023); any Chromium-based browser built on unpatched V8 remains vulnerable, and no public proof-of-concept is known. CISA added CVE-2023-4762 to the Known Exploited Vulnerabilities catalog on 2024-02-06, confirming exploitation in the wild (ransomware use unconfirmed), and EPSS assigns a ~41% probability of exploitation within 30 days (99th percentile).

What to do: Patch all Chromium-based browsers fleet-wide to Chrome 116.0.5845.179/.180 or later and each vendor's equivalent (current Edge, Opera, Brave, etc.), consistent with the CISA KEV required action to apply vendor mitigations or discontinue use. Verify Chromium/V8 browser versions in your endpoint inventory before and after rollout; since exploitation is triggered by a crafted web page, interim mitigations include restricting unpatched machines' browsing and warning users about unsolicited links.