FeedlyFeedly
CVEsCVEs
Threat IntelligenceThreat Intelligence
Threat IntelligenceThreat Intelligence
Log in
ChangelogChangelog
ChangelogChangelog
Log in
Log in
Start Free Trial
Start Free Trial
FeedlyFeedly
CVEsCVEs
Threat IntelligenceThreat Intelligence
Threat IntelligenceThreat Intelligence
Log in
ChangelogChangelog
ChangelogChangelog
Log in
Log in
Start Free Trial
Start Free Trial

CVE-2024-9957

Use After Free (CWE-416)

Published: Oct 15, 2024 / Updated: 35d ago

010
CVSS 8.8EPSS 0.04%High
CVE info copied to clipboard

Summary

Use after free vulnerability in UI in Google Chrome on iOS prior to version 130.0.6723.58. This vulnerability allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page, but only if they could convince a user to engage in specific UI gestures.

Impact

If exploited, this vulnerability could lead to heap corruption, which may result in arbitrary code execution, information disclosure, or application crashes. The potential impacts are severe, with high impacts on confidentiality, integrity, and availability. The CVSS v3.1 base score is 8.8 (High), indicating a significant risk. However, user interaction is required for successful exploitation, which somewhat mitigates the risk.

Exploitation

There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.

Patch

A patch is available. The vulnerability has been addressed in Google Chrome for iOS version 130.0.6723.58 and later.

Mitigation

1. Update Google Chrome on iOS devices to version 130.0.6723.58 or later. 2. Implement user awareness training to educate about the risks of interacting with suspicious web pages or following unverified instructions for UI gestures. 3. Consider implementing browser isolation technologies to protect against client-side attacks. 4. Monitor for any unusual browser activity or crashes that could indicate exploitation attempts. 5. Implement network security measures to detect and block potential attack vectors delivering crafted HTML pages.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Timeline

Detection in Vulnerability Scanners

Detection for the vulnerability has been added to Qualys (380705)

Oct 15, 2024 at 7:53 AM
First Article

Feedly found the first article mentioning CVE-2024-9957. See article

Oct 15, 2024 at 8:05 PM / Neowin News Feed for: Software
CVE Assignment

NVD published the first details for CVE-2024-9957

Oct 15, 2024 at 9:15 PM
CVSS Estimate

Feedly estimated the CVSS score as HIGH

Oct 15, 2024 at 9:21 PM
Detection in Vulnerability Scanners

Detection for the vulnerability has been added to Nessus (209038)

Oct 15, 2024 at 11:15 PM
Detection in Vulnerability Scanners

Detection for the vulnerability has been added to Nessus (209037)

Oct 15, 2024 at 11:15 PM
Detection in Vulnerability Scanners

Detection for the vulnerability has been added to Nessus (209036)

Oct 15, 2024 at 11:15 PM
EPSS

EPSS Score was set to: 0.04% (Percentile: 9.7%)

Oct 16, 2024 at 9:58 AM
CVSS

A CVSS base score of 8.8 has been assigned.

Oct 16, 2024 at 8:40 PM / nvd
Static CVE Timeline Graph

Affected Systems

Google/chrome
+null more

Patches

Microsoft
+null more

References

MS-ISAC CYBERSECURITY ADVISORY - Multiple Vulnerabilities in Google Chrome Could Allow for Arbitrary Code Execution - PATCH NOW
Top posts on r/k12cybersecurity / 34d
Successful exploitation of the most severe of these vulnerabilities could allow for arbitrary code execution in the context of the logged on user. Successful exploitation of the most severe of these vulnerabilities could allow for arbitrary code execution in the context of the logged on user.

News

Multiple vulnerabilities in Prisma Access Browser
Security feed from CyberSecurity Help / 17h
A remote attacker can trick the victim into visiting a specially crafted web page, trigger a use-after-free error and gain access to sensitive information. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.
Fedora 41 : chromium (2024-3a6f9ab958)
Newest Plugins from Tenable / 5d
Nessus Plugin ID 211343 with High Severity Synopsis The remote Fedora host is missing one or more security updates. Description The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-3a6f9ab958 advisory. Update to 130.0.6723.58 * High CVE-2024-9954: Use after free in AI * Medium CVE-2024-9955: Use after free in Web Authentication * Medium CVE-2024-9956: Inappropriate implementation in Web Authentication * Medium CVE-2024-9957: Use after free in UI * Medium CVE-2024-9958: Inappropriate implementation in PictureInPicture * Medium CVE-2024-9959: Use after free in DevTools * Medium CVE-2024-9960: Use after free in Dawn * Medium CVE-2024-9961:
Patch Tuesday November 2024 - 3 Zero Days!
Ultimate Windows Security Newsletter / 6d
So, without further ado, here’s the chart of MS patches that affect Windows platforms in the past month. Of this months patches only 8 are critical and 88 important.
PAN-SA-2024-0016 Chromium: Monthly Vulnerability Updates (Severity: HIGH)
Palo Alto Networks Security Advisories / 6d
Product Confidentiality HIGH Product Integrity HIGH
See 50 more articles and social media posts

CVSS V3.1

Attack Vector:Network
Attack Complexity:Low
Privileges Required:None
User Interaction:Required
Scope:Unchanged
Confidentiality:High
Integrity:High
Availability Impact:High

Categories

CVSS 8.8(18246)CWE-416(5008)

Be the first to know about critical vulnerabilities

Collect, analyze, and share vulnerability reports faster using AI

Feedly Threat Intelligence30-day free trial