CVE-2024-9955
Use After Free (CWE-416)
Published: Oct 15, 2024 / Updated: 35d ago

010

CVSS 8.8EPSS 0.04%High

CVE info copied to clipboard

Summary

Use after free vulnerability in WebAuthentication in Google Chrome prior to version 130.0.6723.58. This vulnerability allows a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Impact

This vulnerability could allow an attacker to execute arbitrary code, potentially leading to unauthorized access, data theft, or system compromise. The impact is considered high for confidentiality, integrity, and availability, indicating that successful exploitation could result in significant damage to the affected system.

Exploitation

There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.

Patch

A patch is available. The vulnerability is fixed in Google Chrome version 130.0.6723.58 and later.

Mitigation

1. Update Google Chrome to version 130.0.6723.58 or later. 2. If immediate patching is not possible, consider disabling or restricting access to WebAuthentication features until the update can be applied. 3. Implement network segmentation and access controls to limit potential attack vectors. 4. Educate users about the risks of visiting untrusted websites or opening suspicious HTML pages.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Timeline

Detection in Vulnerability Scanners

Detection for the vulnerability has been added to Qualys (380705)

Oct 15, 2024 at 7:53 AM

First Article

Feedly found the first article mentioning CVE-2024-9955. See article

Oct 15, 2024 at 8:05 PM / Neowin News Feed for: Software

CVE Assignment

NVD published the first details for CVE-2024-9955

Oct 15, 2024 at 9:15 PM

Detection in Vulnerability Scanners

Detection for the vulnerability has been added to Nessus (209038)

Oct 15, 2024 at 11:15 PM

Detection in Vulnerability Scanners

Detection for the vulnerability has been added to Nessus (209037)

Oct 15, 2024 at 11:15 PM

Detection in Vulnerability Scanners

Detection for the vulnerability has been added to Nessus (209036)

Oct 15, 2024 at 11:15 PM

EPSS

EPSS Score was set to: 0.04% (Percentile: 9.7%)

Oct 16, 2024 at 9:58 AM

Threat Intelligence Report

CVE-2024-9955 is a critical vulnerability related to a use-after-free condition in Web Authentication, which could potentially allow attackers to exploit the flaw. The details regarding its exploitation in the wild, CVSS score, proof-of-concept exploits, mitigations, detections, patches, or downstream impacts on third-party vendors are not provided in the available information. Further investigation is necessary to assess the full scope and implications of this vulnerability. See article

Oct 16, 2024 at 6:47 PM

CVSS

A CVSS base score of 8.8 has been assigned.

Oct 16, 2024 at 8:40 PM / nvd