CVE-2024-4058
Debian Security Advisory 5675-1
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
Type confusion in ANGLE in Google Chrome prior to 124.0.6367.78 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)
La confusión de tipos en ANGLE en Google Chrome anterior a 124.0.6367.78 permitía a un atacante remoto explotar potencialmente la corrupción del montón a través de una página HTML manipulada. (Severidad de seguridad de Chromium: crítica)
An update that fixes 35 vulnerabilities is now available. This update for chromium fixes the following issues. Use after free in Visuals Use after free in ANGLE Heap buffer overflow in WebAudio Use after free in Picture In Picture Use after free in Dawn Type Confusion in ANGLE Out of bounds read in V8 API Use after free in Dawn Object corruption in V8. Object corruption in WebAssembly. Use after free in Downloads. Reported by ChaobinZhang Use after free in QUIC. Inappropriate implementation in Autofill. Out of bounds read in Fonts. Insufficient policy enforcement in Site Isolation. Insufficient data validation in Browser Switcher. Insufficient data validation in Downloads. Inappropriate implementation in Extensions. Inappropriate implementation in Network. Inappropriate implementation in Prompts. Insufficient policy enforcement in WebUI. Out of bounds write in Compositing Heap buffer overflow in ANGLE Use after free in Dawn. Inappropriate implementation in V8 Use after free in Bookmarks. Out of bounds memory access in V8 Use after free in ANGLE Use after free in Dawn Use after free in WebCodecs Type Confusion in WebAssembly Object lifecycle issue in V8. Out of bounds read in Swiftshader Use after free in Canvas. Inappropriate implementation in Downloads.
CVSS Scores
SSVC
- Decision:Track*
Timeline
- 2024-04-23 CVE Reserved
- 2024-04-29 CVE Published
- 2025-03-14 CVE Updated
- 2025-06-07 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-843: Access of Resource Using Incompatible Type ('Type Confusion')
CAPEC
References (2)
URL | Tag | Source |
---|---|---|
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UOC3HLIZCGMIJLJ6LME5UWUUIFLXEGRN | Mailing List |
|
URL | Date | SRC |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|---|---|
https://chromereleases.googleblog.com/2024/04/stable-channel-update-for-desktop_24.html | 2024-06-07 |
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Google Search vendor "Google" | Chrome Search vendor "Google" for product "Chrome" | < 124.0.6367.78 Search vendor "Google" for product "Chrome" and version " < 124.0.6367.78" | - |
Affected
| ||||||
Fedoraproject Search vendor "Fedoraproject" | Fedora Search vendor "Fedoraproject" for product "Fedora" | 40 Search vendor "Fedoraproject" for product "Fedora" and version "40" | - |
Affected
|