CVE-2023-5474
📋 TL;DR
A heap buffer overflow vulnerability in Chrome's PDF renderer allows remote attackers to potentially exploit heap corruption via a crafted PDF file. Users must be tricked into opening a malicious PDF and performing specific interactions. This affects all Chrome users on vulnerable versions.
💻 Affected Systems
- Google Chrome
- Chromium-based browsers
📦 What is this software?
Chrome by Google
Google Chrome is the world's most popular web browser, used by over 3 billion users globally across Windows, macOS, Linux, Android, and iOS platforms. As a Chromium-based browser developed by Google, Chrome dominates the browser market with approximately 65% market share, making it a critical compon...
Learn more about Chrome →⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to full system compromise, data theft, or ransomware deployment.
Likely Case
Browser crash (denial of service) or limited information disclosure from memory corruption.
If Mitigated
No impact if Chrome is updated to patched version or PDF interactions are blocked.
🎯 Exploit Status
Requires user interaction with malicious PDF (specific interactions mentioned in CVE). No public exploit code known.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 118.0.5993.70 and later
Vendor Advisory: https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop_10.html
Restart Required: Yes
Instructions:
Open Chrome
Click menu (three dots) → Help → About Google Chrome
Chrome will automatically check for and install updates
Click 'Relaunch' to restart Chrome
🔧 Temporary Workarounds
Disable Chrome PDF Viewer
allUse external PDF viewer instead of built-in Chrome PDF renderer
chrome://settings/content/pdfDocuments → Toggle 'Download PDF files instead of automatically opening them in Chrome'
Block PDF downloads
allUse web proxy or firewall to block PDF file downloads
🧯 If You Can't Patch
- Use alternative browser for PDF viewing
- Implement application whitelisting to prevent Chrome execution
🔍 How to Verify
Check if Vulnerable:
Check Chrome version is below 118.0.5993.70Check Version:
chrome://version/ (on Chrome) or google-chrome --version (command line)Verify Fix Applied:
Confirm Chrome version is 118.0.5993.70 or higher📡 Detection & Monitoring
Log Indicators:
- Chrome crash reports
- Unexpected PDF file access in user activity logs
Network Indicators:
- Downloads of PDF files from untrusted sources
- Unusual outbound connections after PDF viewing
SIEM Query:
source="chrome_crash_reports" AND version<"118.0.5993.70" AND process="chrome"🔗 References
- https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop_10.html
- https://crbug.com/1483194
- https://security.gentoo.org/glsa/202311-11
- https://security.gentoo.org/glsa/202312-07
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5526
- https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop_10.html
- https://crbug.com/1483194
- https://security.gentoo.org/glsa/202311-11
- https://security.gentoo.org/glsa/202312-07
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5526
