// For flags

CVE-2024-3838

Debian Security Advisory 5668-1

Severity Score

5.5
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Track
*SSVC
Descriptions

Inappropriate implementation in Autofill in Google Chrome prior to 124.0.6367.60 allowed an attacker who convinced a user to install a malicious app to perform UI spoofing via a crafted app. (Chromium security severity: Medium)

La implementación inadecuada de Autocompletar en Google Chrome anterior a 124.0.6367.60 permitió que un atacante convenciera a un usuario de instalar una aplicación maliciosa para realizar una suplantación de la interfaz de usuario a través de una aplicación manipulada. (Severidad de seguridad de Chromium: media)

An update that fixes 35 vulnerabilities is now available. This update for chromium fixes the following issues. Use after free in Visuals Use after free in ANGLE Heap buffer overflow in WebAudio Use after free in Picture In Picture Use after free in Dawn Type Confusion in ANGLE Out of bounds read in V8 API Use after free in Dawn Object corruption in V8. Object corruption in WebAssembly. Use after free in Downloads. Reported by ChaobinZhang Use after free in QUIC. Inappropriate implementation in Autofill. Out of bounds read in Fonts. Insufficient policy enforcement in Site Isolation. Insufficient data validation in Browser Switcher. Insufficient data validation in Downloads. Inappropriate implementation in Extensions. Inappropriate implementation in Network. Inappropriate implementation in Prompts. Insufficient policy enforcement in WebUI. Out of bounds write in Compositing Heap buffer overflow in ANGLE Use after free in Dawn. Inappropriate implementation in V8 Use after free in Bookmarks. Out of bounds memory access in V8 Use after free in ANGLE Use after free in Dawn Use after free in WebCodecs Type Confusion in WebAssembly Object lifecycle issue in V8. Out of bounds read in Swiftshader Use after free in Canvas. Inappropriate implementation in Downloads.

*Credits: N/A
CVSS Scores
Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
Low
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None
Attack Vector
Local
Attack Complexity
Low
Authentication
None
Confidentiality
None
Integrity
Complete
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:Track
Exploitation
None
Automatable
No
Tech. Impact
Partial
* Organization's Worst-case Scenario
Timeline
  • 2024-04-15 CVE Reserved
  • 2024-04-17 CVE Published
  • 2025-02-13 CVE Updated
  • 2025-05-26 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-358: Improperly Implemented Security Check for Standard
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Google
Search vendor "Google"
 Chrome
Search vendor "Google" for product "Chrome"
 < 124.0.6367.60
Search vendor "Google" for product "Chrome" and version " < 124.0.6367.60"
-
Affected