# MA-1007.122023: MyCERT Advisory - Zero-Day Vulnerability in Google Chrome

**Date:** 22 Dec 2023  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-1007.122023  
**Advisory ID:** MA-1007.122023

---

**1.0 Introduction**
Google has released security patches for the Chrome browser in order to fix a zero-day vulnerability of high severity that it claims has been used in the wild. The WebRTC framework contains a heap-based buffer overflow vulnerability that has been given the CVE identification CVE-2023-7024. It has been described as a vulnerability that might be exploited to cause programme crashes or arbitrary code execution.
**2.0 Impact**
Allows the possibility of heap corruption to be exploited remotely by an attacker using a malicious HTML page.
**3.0 Affected Products**
The affected Chrome browsers are;
- All prior to version 120.0.6099.129/130 for Windows.
- All prior to version 120.0.6099.129 for Mac and Linux.
**4.0 Recommendations**
Users are recommended to update to version 120.0.6099.129 for macOS and Linux and 120.0.6099.129/130 for Windows to mitigate potential threats. Users are also encouraged to enable the automatic update function in Chrome to ensure that their software is updated promptly.
Generally, MyCERT advises the users of this devices to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail: cyber999[at]cybersecurity.my 
Phone: 1-300-88-2999 (monitored during business hours) 
Mobile: +60 19 2665850 (24x7 call incident reporting) 
Business Hours: Mon - Fri 09:00 -18:00 MYT 
Web: <https://www.mycert.org.my> 
Twitter: <https://twitter.com/mycert> 
Facebook: <https://www.facebook.com/mycert.org.my>
**5.0    References**
- <https://chromereleases.googleblog.com/2023/12/stable-channel-update-for-desktop_20.html>
- <https://thehackernews.com/2023/12/urgent-new-chrome-zero-day.html?m=1>
- <https://www.bleepingcomputer.com/news/security/google-fixes-8th-chrome-zero-day-exploited-in-attacks-this-year/>
- <https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-7024>
- <https://digital.nhs.uk/cyber-alerts/2023/cc-4424>