Intel

CVE-2023-5217

Google Chromium libvpx — Google Chromium libvpx Heap Buffer Overflow Vulnerability

criticalKEV: actively exploitedPoCEPSS 49%

Description

Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Source: CISA_KEVNVDCVEORGOSVCVELISTV5

Response & Mitigation

Why act now?

Prioritisation rationale

With an EPSS score at the 98.8th percentile, CVE-2023-5217 sits among the most likely-to-be-exploited vulnerabilities currently tracked, driven by the extremely low attack complexity: an attacker needs only to lure a user to a crafted page (AV:N, AC:L, UI:R). The CVSS 8.8 score reflects full confidentiality, integrity, and availability impact on the affected process, making browser-delivered code execution a realistic outcome. Organisations running large fleets of Electron-based productivity tools face a compounded risk because those applications bundle libvpx independently of the Chrome update channel and are frequently overlooked in patch prioritisation. CISA has not flagged known ransomware campaign use, but the low exploitation barrier makes this attractive for opportunistic initial-access operations; NIS2-scoped entities should treat this as a P1 patch within the 24-hour window.

Runbook · Step 1

Immediate response (0-24 h)

  • Update Google Chrome immediately to version 117.0.5938.132 or later. Force rollout via GPO/MDM; verify via chrome://version. The patch is not effective until the browser process is restarted.
  • Patch Electron-based applications: Electron versions 24.x, 25.x, 26.x, and 27.0.0-alpha.1 ship the vulnerable libvpx. Target patch releases are 24.8.3, 25.8.3, 26.2.1, and 27.0.0-alpha.7 or later — verify exact version numbers in the respective vendor advisory before deploying.
  • Audit libvpx system-wide: On Linux, run dpkg -l libvpx* or rpm -qa | grep libvpx; any version below 1.13.1 is vulnerable. Update via the distribution repository (e.g. apt upgrade libvpx7).
  • Restrict browser access on critical systems: Temporarily block or redirect browser usage on KRITIS/OT assets (SCADA HMIs, jump servers, OT gateways) until the patch is confirmed deployed.
  • Inventory Chromium-embedded applications: Query asset management for libvpx.dll / libvpx.so. CEF-based products — Teams (classic), Slack, VS Code, Zoom — bundle libvpx and may lag behind Chrome's patch cycle. Treat each as a separate patching workstream.

Runbook · Step 2

Mitigation layers

  • Network segmentation: Restrict outbound HTTP/HTTPS from production and OT segments to an explicit allowlist via proxy. This prevents endpoints from loading attacker-controlled HTML pages that trigger the VP8 encoding path.
  • Web proxy / content filtering: Block "Newly Registered Domains" and "Uncategorized" categories at the proxy. Enable inline TLS inspection to catch malicious WebM/IVF payloads delivered over HTTPS.
  • IPS signature activation: Enable CVE-2023-5217 signatures in Suricata or Snort (ET PRO / Snort VRT rulesets). Reference the cve,2023-5217 tag in the Emerging Threats ruleset and confirm the rule is in blocking mode, not alert-only.
  • Application allowlisting: Use AppLocker or WDAC to block execution of uninventoried Electron binaries. This prevents users from running unpatched Electron apps that IT has not yet assessed.
  • Browser sandbox enforcement: Ensure --no-sandbox is absent from all Chrome deployment policies. Renderer processes must run in the Low Integrity context so that heap corruption cannot directly reach kernel or other user-mode processes.
  • Least-privilege for browser processes: Do not run Chrome or Electron apps under administrative accounts. Combine with EDR memory-protection policies (e.g. CrowdStrike Falcon's heap-spray prevention) as a compensating control while patches are staged.

Runbook · Step 3

Detection rules

  • Process anomaly (Sysmon EID 1 / EDR): Child processes of chrome.exe or Electron binaries spawning cmd.exe, powershell.exe, or mshta.exe. KQL sketch: DeviceProcessEvents | where InitiatingProcessFileName =~ "chrome.exe" and FileName in ("cmd.exe","powershell.exe","wscript.exe","mshta.exe").
  • Crash telemetry (Windows Application Log EID 1000/1001): Monitor for crash reports from chrome.exe or Electron apps with faulting module libvpx.dll. A cluster of crashes immediately before a successful exploitation attempt is a known pre-exploitation pattern.
  • Network telemetry (Zeek/Suricata): HTTP GET requests for .webm or .ivf files from uncategorised external hosts, followed by outbound connections to new or rare destinations from the same endpoint within minutes.
  • EDR memory-protection alerts: Treat HEAP_CORRUPTION, WRITE_AV, or DEP_VIOLATION alerts in Chrome renderer processes as High severity. Filter CrowdStrike/SentinelOne telemetry for these exception types in the chrome.exe process tree.
  • Sigma rule shape: title: Suspicious Child Process Spawned by Chromium — parent image matches *chrome.exe or *electron*, child image in (cmd.exe, powershell.exe, mshta.exe, wscript.exe, cscript.exe) — severity: High.

Metrics

Severity
critical
Priority score
207.34
KEV status
Actively exploited
Exploit maturity
actively exploited (KEV)
XIEM Effective CVSS
8.8
Source: nvd-v3
CVSS v3
8.8
CVSS v4
—
EPSS percentile
98.8 %
Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).
EPSS score
49.0 %
Elevated — model estimates 10-50% exploitation likelihood.
Published
2023-10-02 00:00 UTC
CWE
—

Affected operating systems

  • linux

    debian / debian_linux10.0

  • linux

    debian / debian_linux11.0

  • linux

    debian / debian_linux12.0

  • linux

    redhat / enterprise_linux9.0

  • mobile

    apple / iphone_os16.7

  • mobile

    apple / iphone_os

  • other

    fedoraproject / fedora37

  • other

    fedoraproject / fedora38

  • other

    fedoraproject / fedora39

  • other

    apple / ipados16.7

  • other

    apple / ipados

Affected products

Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.

  • npm

    electron24.0.0

  • npm

    electron25.0.0

  • npm

    electron26.0.0

  • npm

    electron27.0.0-alpha.1

  • npm

    electron

Public exploit references

Public proof-of-concepts and detection templates for this vulnerability. Maturity ranges from reported PoCs through working detection scripts up to fully weaponized exploit modules. NEOSEC mirrors the code internally for forensic analysis; externally we only link to the original sources.

References & sources

IDCVE-2023-5217