CVE-2023-7010 is a high severity (CVSS 8.8) use after free in WebRTC in Google Chrome before 117.0.5938.62, rated High by the Chromium project. A crafted HTML page could cause heap corruption. Update Chrome to 117.0.5938.62 or later and relaunch the browser.
What's affected
The record says Google Chrome prior to 117.0.5938.62 is affected. Google's Stable Channel Update of 12 September 2023 promotes Chrome 117 and lists 117.0.5938.62 for Linux and Mac and 117.0.5938.62 or .63 for Windows, with 21 security fixes in that release.
The CVE was published in the record on 2024-07-16, long after the Chrome fix shipped, so browsers that updated normally in late 2023 already have it. The risk is on machines that are not updating.
How to check if you're exposed
Open chrome://version in the browser, or run the command line for your platform.
google-chrome --version # Linux
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version # macOS
On Windows, use Settings, About Chrome. The fixed build per Google's release notes is 117.0.5938.62 for Linux and Mac and 117.0.5938.62 or .63 for Windows. Also check other Chromium-based browsers and embedded runtimes such as Electron apps, which update on their own schedule.
What to do now
- Update Chrome to a current stable release. Anything at or above 117.0.5938.62 includes this fix.
- Relaunch the browser after updating, since the update applies on restart.
- Check managed fleets for browsers pinned to old versions.
- Update other Chromium-based browsers and Electron-based apps from their vendors.
Why it matters
A use after free means the browser keeps using memory after it was released. If an attacker can control what is placed there, the result is heap corruption, which the record says could be exploited via a crafted HTML page. The record tags CWE-416. Chromium rates the bug High. The record does not mark this CVE as known exploited.
Browser engines are large, written mostly in C++, and see untrusted input all day, so use after free bugs recur. Sandboxing and rapid auto-update are the main defenses, which makes the update cadence the control that matters.
Browsers are the most exposed software on most desktops, and they update on their own when allowed. Set a maximum age for browser versions, enforce it with device management, and treat managed machines that block updates as the real gap.
Weakness class in the record: CWE-416 (Use After Free).
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Why is a 2024 record about a 2023 fix?
The CVE identifier was published in July 2024 for a bug already fixed in Chrome 117. Check the fixed version, not the publication date.
How fast should browser updates reach our fleet?
Within days. Auto-update makes this cheap. Set a policy for the maximum age of a browser version and enforce it through device management.
Sources
Last reviewed: 19 October 2026.
