CVE-2024-9959
Use After Free (CWE-416)
Summary
Use after free vulnerability in DevTools in Google Chrome prior to version 130.0.6723.58 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted Chrome Extension. This vulnerability is classified as Medium severity by Chromium security standards.
Impact
This vulnerability could allow an attacker who has already compromised the renderer process to exploit heap corruption through a crafted Chrome Extension. The potential impacts include: 1. Arbitrary code execution with the privileges of the Chrome browser process. 2. High impact on confidentiality, integrity, and availability of the affected system. 3. The attack vector is network-based, requires low attack complexity, but does require user interaction. 4. Given the CVSS score of 8.8 (High), this vulnerability should be considered a priority for patching efforts. These attacks could manifest as: - Malicious Chrome extensions executing unauthorized code. - Potential data theft or manipulation within the browser environment. - Possible lateral movement or escalation of privileges if the attacker can leverage the browser's permissions.
Exploitation
There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.
Patch
A patch is available. The vulnerability is fixed in Google Chrome version 130.0.6723.58 and later. It is crucial to update to this version or a newer one to mitigate the risk.
Mitigation
1. Update Google Chrome to version 130.0.6723.58 or later as soon as possible. 2. Implement network segmentation and strict access controls to limit potential attack vectors. 3. Educate users about the risks of installing untrusted Chrome Extensions. 4. Consider using browser isolation technologies to contain potential threats. 5. Regularly monitor and audit installed Chrome Extensions across the organization. 6. Implement a robust patch management process to ensure timely updates of Chrome across all systems. 7. Consider temporarily disabling Chrome Extensions in high-risk environments until patching is complete.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Timeline
Detection for the vulnerability has been added to Qualys (380705)
Feedly found the first article mentioning CVE-2024-9959. See article
NVD published the first details for CVE-2024-9959
Feedly estimated the CVSS score as HIGH
Detection for the vulnerability has been added to Nessus (209038)
Detection for the vulnerability has been added to Nessus (209037)
Detection for the vulnerability has been added to Nessus (209036)
EPSS Score was set to: 0.04% (Percentile: 9.7%)
A CVSS base score of 8.8 has been assigned.