---
title: Threat Bulletin – CVE-2023-7024
description: Learn how a heap buffer overflow in WebRTC in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
image: https://www.morphisec.com/hubfs/CVE-2023-7024%20Threat%20Bulletin.jpg
---

Recent Webinar: Building an Adaptive Cyber Resilient Cloud

![arrow-white](https://www.morphisec.com/hubfs/arrow-white.svg) ![arrow-white](https://www.morphisec.com/hubfs/arrow-white.svg) [![Watch now](https://no-cache.hubspot.com/cta/default/1534169/6359793e-b232-4b79-9da5-b929fc3dc7aa.png)](https://cta-redirect.hubspot.com/cta/redirect/1534169/6359793e-b232-4b79-9da5-b929fc3dc7aa)

![close](https://www.morphisec.com/hubfs/close.svg)

![search_icon](https://www.morphisec.com/hubfs/search_icon.svg)

[![Morphisec-Logo](https://www.morphisec.com/hubfs/Morphisec-Logo.svg "Morphisec-Logo")](http://www.morphisec.com)

![blog](https://www.morphisec.com/hubfs/blog.svg) [![Read the Blog](https://no-cache.hubspot.com/cta/default/1534169/3c83d6d5-0c56-47b7-8aee-ae6edf73c360.png)](https://cta-redirect.hubspot.com/cta/redirect/1534169/3c83d6d5-0c56-47b7-8aee-ae6edf73c360)

[![Get A Demo](https://no-cache.hubspot.com/cta/default/1534169/d4f17ebf-d8a2-49c3-9bca-a8f8112b45f3.png)](https://cta-redirect.hubspot.com/cta/redirect/1534169/d4f17ebf-d8a2-49c3-9bca-a8f8112b45f3)

[![Morphisec-Logo](https://www.morphisec.com/hubfs/Morphisec-Logo.svg "Morphisec-Logo")](http://www.morphisec.com)

![search_icon](https://www.morphisec.com/hubfs/search_icon.svg)

- ![blog](https://www.morphisec.com/hubfs/blog.svg) [![Read the Blog](https://no-cache.hubspot.com/cta/default/1534169/3c83d6d5-0c56-47b7-8aee-ae6edf73c360.png)](https://cta-redirect.hubspot.com/cta/redirect/1534169/3c83d6d5-0c56-47b7-8aee-ae6edf73c360)
- [![Get A Demo](https://no-cache.hubspot.com/cta/default/1534169/d4f17ebf-d8a2-49c3-9bca-a8f8112b45f3.png)](https://cta-redirect.hubspot.com/cta/redirect/1534169/d4f17ebf-d8a2-49c3-9bca-a8f8112b45f3)

Cybersecurity Blog

Cybersecurity News, Threat Research, and more from the Team Spearheading the Evolution of Endpoint Security

# Threat Bulletin – CVE-2023-7024

Posted by [Jay Kurup](https://1534169.hs-sites.com/author/jay-kurup) on January 8, 2024

- [Tweet](https://twitter.com/share)

Heap buffer overflow in WebRTC in Google Chrome prior to 120.0.6099.129 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

**CVE ID: **CVE-2023-7024**  ** 

**Published: **21-Dec-2023, updated 3-Jan-2024 

**Vulnerable Software:** Google Chrome versions below 120.0.6099.129 

**Severity: **High 

**Potential Impact: **High as it allows users to take control of the system 

**Exploited in the wild: **Yes, due to notification published by Google and CISA   

**Reference:**  

- **CVE listing:** [https://nvd.nist.gov/vuln/detail/CVE-2023-7024](https://nvd.nist.gov/vuln/detail/CVE-2023-7024)
- **CISA KEV (Known Exploited Vulnerability) listing:**  
  [https://www.cisa.gov/news-events/alerts/2024/01/02/cisa-adds-two-known-exploited-vulnerabilities-catalog ](https://www.cisa.gov/news-events/alerts/2024/01/02/cisa-adds-two-known-exploited-vulnerabilities-catalog%E2%80%AF%E2%80%AF)
- **Google Security Bulletin:**  
  [https://chromereleases.googleblog.com/2023/12/stable-channel-update-for-desktop_20.html](https://chromereleases.googleblog.com/2023/12/stable-channel-update-for-desktop_20.html) 

![CVE-2023-7024 Threat Bulletin](https://www.morphisec.com/hubfs/CVE-2023-7024%20Threat%20Bulletin.jpg)  

### **Description:  ** 

WebRTC (Web Real-Time Communications) provides additional communication functionality to web browsers. 

WebRTC is a free, open-source project that allows web browsers and mobile applications to add real-time audio and video peer-to-peer connections and communication functionality allowing quick communication in real time.  

You can communicate directly inside web pages and applications without requiring additional plug-ins with these WebRTC data channels. The technology is implemented via regular JavaScript APIs (Application Programming Interfaces) in major web browsers, like Google Chrome, Mozilla Firefox, and Microsoft Edge. For example, a website using this technology can access a user's microphone or webcam. In advanced cases, web apps provide video calling and screen sharing functionality, like in Google Hangouts and similar programs. 

Details on how the vulnerability is exploited in the wild have not been published, yet based on the available details end user interaction is required for exploitation of this vulnerability. 

The attacker would need to create a crafted HTML page which on clicking would lead to the exploitation of the vulnerability allowing attackers to run malicious code remotely. 

 

### **Morphisec Protection Mechanisms:**  

Virtual Patching of the application by [Automated Moving Target Defense (AMTD)](https://www.morphisec.com/moving-target-defense) 

Visibility of vulnerable versions of Chrome  

 

### **How Morphisec prevents the attack: ** 

Morphisec’s AMTD Implementation offers Virtual Patching protection for the vulnerability. Morphisec protects the web browsers and by application of AMTD negates the vulnerability itself by constantly re-arranging the attack surface during application load time 

This protection is significant as AMTD application offers signatureless protection and is resistant to changing techniques of the attackers. 

Morphisec Exposure Management platforms also provides clear visibility of the systems running vulnerable versions of the application and tags the same with the CISA KEV advisory to better prioritize the patching strategy. 

 ![Morphisec CVE-2023-7024 Prevention](https://www.morphisec.com/hubfs/Morphisec%20CVE-2023-7024%20Prevention.png)

 

### **Mitigation recommendations: ** 

- Apply browser updates  
- Ensure Morphisec protects all devices with chrome browsers

 

Want to learn more about how Morphisec stops this and other new and emerging threats? [Schedule a demo with our team today.](https://www.morphisec.com/schedule)

[![New call-to-action](https://no-cache.hubspot.com/cta/default/1534169/50832359-01e9-4911-98db-45bd66a69b90.png)](https://cta-redirect.hubspot.com/cta/redirect/1534169/50832359-01e9-4911-98db-45bd66a69b90)

### Subscribe to our blog

Stay in the loop with industry insight, cyber security trends, and cyber attack information and company updates.

[![New call-to-action](https://no-cache.hubspot.com/cta/default/1534169/e098d357-1710-4cfe-8901-19c93de122f4.png)](https://cta-redirect.hubspot.com/cta/redirect/1534169/e098d357-1710-4cfe-8901-19c93de122f4)

### Search Our Site

### Recent Posts

### Posts by Tag

- [Automated Moving Target Defense (157)](https://1534169.hs-sites.com/topic/automated-moving-target-defense)
- [Threat Research (135)](https://1534169.hs-sites.com/topic/threat-research)
- [Cyber Security News (132)](https://1534169.hs-sites.com/topic/cyber-security-news)
- [Morphisec Labs (127)](https://1534169.hs-sites.com/topic/morphisec-labs)
- [Morphisec News (54)](https://1534169.hs-sites.com/topic/morphisec-news)
- [Adaptive Exposure Management (14)](https://1534169.hs-sites.com/topic/adaptive-exposure-management)
- [Defense-in-Depth (13)](https://1534169.hs-sites.com/topic/defense-in-depth)
- [Ransomware (12)](https://1534169.hs-sites.com/topic/ransomware)
- [Preemptive Security (11)](https://1534169.hs-sites.com/topic/preemptive-security)
- [Gartner (10)](https://1534169.hs-sites.com/topic/gartner)
- [Continuous Threat Exposure Management (CTEM) (9)](https://1534169.hs-sites.com/topic/continuous-threat-exposure-management-ctem)
- [Microsoft (8)](https://1534169.hs-sites.com/topic/microsoft)
- [In-Memory Attacks (7)](https://1534169.hs-sites.com/topic/in-memory-attacks)
- [Healthcare Cybersecurity (6)](https://1534169.hs-sites.com/topic/healthcare-cybersecurity)
- [Advanced Threat Defense (5)](https://1534169.hs-sites.com/topic/advanced-threat-defense)
- [Financial Cybersecurity (5)](https://1534169.hs-sites.com/topic/financial-cybersecurity)
- [Legacy Security (5)](https://1534169.hs-sites.com/topic/legacy-security)
- [Artificial Intelligence (4)](https://1534169.hs-sites.com/topic/artificial-intelligence)
- [Linux Cybersecurity (4)](https://1534169.hs-sites.com/topic/linux-cybersecurity)
- [Fileless Malware (3)](https://1534169.hs-sites.com/topic/fileless-malware)
- [Threat and Vulnerability Management (2)](https://1534169.hs-sites.com/topic/threat-and-vulnerability-management)
- [Managed Service Providers (1)](https://1534169.hs-sites.com/topic/managed-service-providers)

[See all](https://1534169.hs-sites.com/threat-bulletin-cve-2023-7024#)

- [![X](https://1534169.hs-sites.com/hubfs/x_twitter_icon.svg)](https://twitter.com/morphisec)
- [![Linkedin](https://1534169.hs-sites.com/hubfs/linkedin_icon.svg)](https://www.linkedin.com/company/morphisec)
- [![Youtube](https://1534169.hs-sites.com/hubfs/youtube_icon.svg)](https://www.youtube.com/channel/UCe48cR5xTxPJSYMjG-So7Rw)

© 2026 Morphisec Ltd. | All rights reserved

![iso27001-(2)](https://www.morphisec.com/hubfs/iso27001-(2).png)

```json
{
  "@context" : "https://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Jay Kurup",
    "url" : "https://1534169.hs-sites.com/author/jay-kurup"
  },
  "dateModified" : "2024-01-08T20:12:00.531Z",
  "datePublished" : "2024-01-08T16:25:45.000Z",
  "headline" : "Threat Bulletin – CVE-2023-7024",
  "image" : [ "https://www.morphisec.com/hubfs/CVE-2023-7024%20Threat%20Bulletin.jpg" ],
  "mainEntityOfPage" : {
    "@id" : "https://1534169.hs-sites.com/threat-bulletin-cve-2023-7024",
    "@type" : "WebPage"
  },
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "url" : "https://www.morphisec.com/hubfs/morphisec-logo-color-horz.png"
    },
    "name" : "Morphisec"
  }
}
```