CVE-2024-9859

Access of Resource Using Incompatible Type ('Type Confusion') (CWE-843)

Published: Oct 11, 2024 / Updated: 39d ago

010
CVSS 8.8EPSS 0.04%High
CVE info copied to clipboard

Summary

Type confusion in WebAssembly in Google Chrome prior to version 126.0.6478.126 allowed a remote attacker to execute arbitrary code via a crafted HTML page.

Impact

This vulnerability allows a remote attacker to execute arbitrary code on the target system. This can lead to complete compromise of the affected system, potentially resulting in unauthorized access, data theft, and system manipulation. The vulnerability has high impacts on confidentiality, integrity, and availability of the system.

Exploitation

There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.

Patch

A patch is available. The vulnerability is fixed in Google Chrome version 126.0.6478.126 and later.

Mitigation

Update Google Chrome to version 126.0.6478.126 or later. Until the update can be applied, consider using alternative browsers for critical tasks, and exercise caution when browsing unfamiliar websites. Implement network security measures to detect and block potential exploit attempts.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Timeline

CVE Assignment

NVD published the first details for CVE-2024-9859

Oct 11, 2024 at 5:15 PM
First Article

Feedly found the first article mentioning CVE-2024-9859. See article

Oct 11, 2024 at 5:24 PM / National Vulnerability Database
CVSS Estimate

Feedly estimated the CVSS score as HIGH

Oct 11, 2024 at 5:24 PM
EPSS

EPSS Score was set to: 0.04% (Percentile: 9.7%)

Oct 12, 2024 at 10:03 AM
CVSS

A CVSS base score of 8.8 has been assigned.

Oct 15, 2024 at 7:40 PM / nvd
Static CVE Timeline Graph

Affected Systems

Google/chrome
+null more

CVSS V3.1

Attack Vector:Network
Attack Complexity:Low
Privileges Required:None
User Interaction:Required
Scope:Unchanged
Confidentiality:High
Integrity:High
Availability Impact:High

Categories

Be the first to know about critical vulnerabilities

Collect, analyze, and share vulnerability reports faster using AI