5.4Mittel
Google Chrome
Incorrect authorization in Blink in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)
8.3Hoch
KEV
CVE-2024-5274Google Chromium V8 Type Confusion Vulnerability
Bekannt ausgenutzt — Google Chromium V8 Type Confusion Vulnerability
CISA hat am 28.05.2024 bestätigt, dass diese Schwachstelle in echten Angriffen genutzt wird. Frist für US-Bundesbehörden: 18.06.2024.
Erforderliche Maßnahme: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. https://chromereleases.googleblog.com/2024/05/stable-channel-update-for-desktop_23.html?m=1; https://nvd.nist.gov/vuln/detail/CVE-2024-5274
Beschreibung
Type Confusion in V8 in Google Chrome prior to 125.0.6422.112 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
Schwachstellentyp (CWE):
CWE-843
Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.
Betroffene Produkte und Versionen
| Hersteller | Produkt | Versionen | |
|---|---|---|---|
| fedoraproject | fedora | 39 | |
| Chrome | 125.0.6422.112 – < 125.0.6422.112 |
Referenzen und Patches
- https://chromereleases.googleblog.com/2024/05/stable-channel-update-for-desktop_23.html Release Notes
- https://issues.chromium.org/issues/341663589 ExploitIssue Tracking
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T6IBUYVPD4MIFQ… Mailing List
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AVC3FNI7HZLVSR… Mailing List
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-5274 US Government Resource
CPE-Treffer (NVD) (3)
cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*< 125.0.6422.112cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:*