Vulnerability DatabaseCVE-2023-36735

CVE-2023-36735:
vulnerability analysis and mitigation

Overview

Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability (CVE-2023-36735) is a critical security flaw with a CVSS score of 9.6. The vulnerability affects Microsoft Edge versions up to (excluding) 117.0.2045.31 and was patched in September 2023 (Security Online, NVD).

Technical details

The vulnerability is classified as a Use After Free (CWE-416) issue that could allow attackers to execute arbitrary code with elevated privileges and potentially escape the browser sandbox. The severity assessment is reflected in its CVSS v3.1 base score of 9.6 (Critical) with the vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H (NVD).

Impact

If successfully exploited, this vulnerability could enable an attacker to escape the browser sandbox and gain access to the underlying operating system with elevated privileges. This level of access could potentially allow the attacker to install malware, steal sensitive data, or take complete control of the affected system (Security Online).

Mitigation and workarounds

Microsoft has addressed this vulnerability in Microsoft Edge version 117.0.2045.31. Users are strongly advised to update their browser to the latest version to protect against this security flaw. No alternative workarounds have been publicly documented (Security Online).