CVE-2024-3839
Debian Security Advisory 5668-1
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
1Exploited in Wild
-Decision
Descriptions
Out of bounds read in Fonts in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)
La lectura fuera de los límites en fuentes en Google Chrome anterior a 124.0.6367.60 permitía a un atacante remoto obtener información potencialmente confidencial de la memoria del proceso a través de una página HTML manipulada. (Severidad de seguridad de Chromium: media)
An update that fixes 35 vulnerabilities is now available. This update for chromium fixes the following issues. Use after free in Visuals Use after free in ANGLE Heap buffer overflow in WebAudio Use after free in Picture In Picture Use after free in Dawn Type Confusion in ANGLE Out of bounds read in V8 API Use after free in Dawn Object corruption in V8. Object corruption in WebAssembly. Use after free in Downloads. Reported by ChaobinZhang Use after free in QUIC. Inappropriate implementation in Autofill. Out of bounds read in Fonts. Insufficient policy enforcement in Site Isolation. Insufficient data validation in Browser Switcher. Insufficient data validation in Downloads. Inappropriate implementation in Extensions. Inappropriate implementation in Network. Inappropriate implementation in Prompts. Insufficient policy enforcement in WebUI. Out of bounds write in Compositing Heap buffer overflow in ANGLE Use after free in Dawn. Inappropriate implementation in V8 Use after free in Bookmarks. Out of bounds memory access in V8 Use after free in ANGLE Use after free in Dawn Use after free in WebCodecs Type Confusion in WebAssembly Object lifecycle issue in V8. Out of bounds read in Swiftshader Use after free in Canvas. Inappropriate implementation in Downloads.
CVSS Scores
SSVC
- Decision:Track
Timeline
- 2024-04-15 CVE Reserved
- 2024-04-17 CVE Published
- 2024-06-16 First Exploit
- 2025-02-13 CVE Updated
- 2025-05-26 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-125: Out-of-bounds Read
CAPEC
References (8)
URL | Date | SRC |
---|---|---|
https://github.com/vin01/poc-cve-2024-38396 | 2024-06-16 |
URL | Date | SRC |
---|
URL | Date | SRC |
---|---|---|
https://chromereleases.googleblog.com/2024/04/stable-channel-update-for-desktop_16.html | 2024-07-03 |
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Google Search vendor "Google" | Chrome Search vendor "Google" for product "Chrome" | < 124.0.6367.60 Search vendor "Google" for product "Chrome" and version " < 124.0.6367.60" | - |
Affected
|