CVE-2024-11395
Access of Resource Using Incompatible Type ('Type Confusion') (CWE-843)
Summary
Type Confusion vulnerability in V8 in Google Chrome prior to version 131.0.6778.85 allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability is classified as High severity by Chromium.
Impact
This vulnerability could allow an attacker to execute arbitrary code or cause a denial of service on affected systems. The impact is significant as it affects confidentiality, integrity, and availability, all rated as HIGH. An attacker could potentially gain unauthorized access to sensitive information, modify data, or disrupt normal operations of the affected Chrome browser.
Exploitation
There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.
Patch
A patch is available. The vulnerability is fixed in Google Chrome version 131.0.6778.85 and later.
Mitigation
1. Update Google Chrome to version 131.0.6778.85 or later immediately. 2. If immediate updating is not possible, consider using alternative browsers until the update can be applied. 3. Implement network segmentation and strict access controls to limit potential attack vectors. 4. Educate users about the risks of visiting untrusted websites or opening suspicious HTML content. 5. Monitor systems for unusual activities that could indicate exploitation attempts.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Timeline
Detection for the vulnerability has been added to Qualys (382381)
Feedly found the first article mentioning CVE-2024-11395. See article
NVD published the first details for CVE-2024-11395
Feedly estimated the CVSS score as HIGH
A CVSS base score of 8.8 has been assigned.
Detection for the vulnerability has been added to Nessus (211583)
Detection for the vulnerability has been added to Nessus (211584)