// For flags

CVE-2024-3839

Debian Security Advisory 5668-1

Severity Score

6.5
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Track
*SSVC
Descriptions

Out of bounds read in Fonts in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)

La lectura fuera de los límites en fuentes en Google Chrome anterior a 124.0.6367.60 permitía a un atacante remoto obtener información potencialmente confidencial de la memoria del proceso a través de una página HTML manipulada. (Severidad de seguridad de Chromium: media)

An update that fixes 35 vulnerabilities is now available. This update for chromium fixes the following issues. Use after free in Visuals Use after free in ANGLE Heap buffer overflow in WebAudio Use after free in Picture In Picture Use after free in Dawn Type Confusion in ANGLE Out of bounds read in V8 API Use after free in Dawn Object corruption in V8. Object corruption in WebAssembly. Use after free in Downloads. Reported by ChaobinZhang Use after free in QUIC. Inappropriate implementation in Autofill. Out of bounds read in Fonts. Insufficient policy enforcement in Site Isolation. Insufficient data validation in Browser Switcher. Insufficient data validation in Downloads. Inappropriate implementation in Extensions. Inappropriate implementation in Network. Inappropriate implementation in Prompts. Insufficient policy enforcement in WebUI. Out of bounds write in Compositing Heap buffer overflow in ANGLE Use after free in Dawn. Inappropriate implementation in V8 Use after free in Bookmarks. Out of bounds memory access in V8 Use after free in ANGLE Use after free in Dawn Use after free in WebCodecs Type Confusion in WebAssembly Object lifecycle issue in V8. Out of bounds read in Swiftshader Use after free in Canvas. Inappropriate implementation in Downloads.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
Complete
Integrity
None
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:Track
Exploitation
None
Automatable
No
Tech. Impact
Partial
* Organization's Worst-case Scenario
Timeline
  • 2024-04-15 CVE Reserved
  • 2024-04-17 CVE Published
  • 2024-06-16 First Exploit
  • 2025-02-13 CVE Updated
  • 2025-05-26 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-125: Out-of-bounds Read
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Google
Search vendor "Google"
Chrome
Search vendor "Google" for product "Chrome"
< 124.0.6367.60
Search vendor "Google" for product "Chrome" and version " < 124.0.6367.60"
-
Affected