Loading vulnerability…
CVE-2023-38840 is a residual-memory exposure in Bitwarden Desktop 2023.7.0 and earlier. Bitwarden Desktop's Electron/Chromium V8 environment can retain immutable JavaScript string data in the renderer-process heap after a vault is locked. Clearing references during locking does not overwrite the underlying string bytes, and V8 garbage collection does not zero freed memory before reuse. An attacker with local access can read or dump the Bitwarden process memory and recover sensitive information, including a Bitwarden master password that remains in plaintext.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository contains a Go-based proof-of-concept exploit (BW-Dump) for CVE-2023-38840, targeting Bitwarden Desktop on Windows (versions 2023.7.0 and below). The tool is designed to extract the master password from the memory of a locked Bitwarden vault, provided the vault was unlocked at least once during the session. The exploit does not require administrative privileges and works by enumerating processes, identifying the Bitwarden Desktop process, and scanning its memory for specific byte patterns that indicate the presence of the master password. The codebase is organized into several Go files: 'main.go' (entry point and CLI), 'lookups.go' (process and memory scanning logic), 'constants.go' (pattern and constant definitions), 'models.go' (data structures), and 'utils.go' (memory dump utility). The README provides detailed usage instructions, example output, and mitigation advice. The exploit is operational as a local post-exploitation tool for forensic or red team use, and does not interact with network endpoints.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.