CVE-2024-9965
Published: Oct 15, 2024 / Updated: 35d ago

010

CVSS 8.8EPSS 0.04%High

CVE info copied to clipboard

Summary

Insufficient data validation in DevTools in Google Chrome on Windows prior to version 130.0.6723.58 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page.

Impact

This vulnerability could allow an attacker to execute arbitrary code on the affected system, potentially leading to full system compromise. The impact is severe, with potential for high confidentiality, integrity, and availability breaches. However, it requires user interaction and is limited to the DevTools feature in Chrome on Windows.

Exploitation

There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.

Patch

A patch is available. Google Chrome versions 130.0.6723.58 and later have addressed this vulnerability.

Mitigation

1. Update Google Chrome to version 130.0.6723.58 or later immediately. 2. Educate users about the risks of interacting with unfamiliar or suspicious web content, especially when using developer tools. 3. Consider restricting access to DevTools for non-developer users in managed environments. 4. Implement network security measures to detect and block potential exploit attempts.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Timeline

Detection in Vulnerability Scanners

Detection for the vulnerability has been added to Qualys (380705)

Oct 15, 2024 at 7:53 AM

First Article

Feedly found the first article mentioning CVE-2024-9965. See article

Oct 15, 2024 at 8:05 PM / Neowin News Feed for: Software

CVE Assignment

NVD published the first details for CVE-2024-9965

Oct 15, 2024 at 9:15 PM

CVSS Estimate

Feedly estimated the CVSS score as HIGH

Oct 15, 2024 at 9:21 PM

Detection in Vulnerability Scanners

Detection for the vulnerability has been added to Nessus (209038)

Oct 15, 2024 at 11:15 PM

Detection in Vulnerability Scanners

Detection for the vulnerability has been added to Nessus (209037)

Oct 15, 2024 at 11:15 PM

Detection in Vulnerability Scanners

Detection for the vulnerability has been added to Nessus (209036)

Oct 15, 2024 at 11:15 PM

EPSS

EPSS Score was set to: 0.04% (Percentile: 9.7%)

Oct 16, 2024 at 9:58 AM

Threat Intelligence Report

CVE-2024-9965 is a vulnerability in DevTools characterized by insufficient data validation, which could potentially lead to exploitation. The criticality of this vulnerability is not specified, and there is no information regarding its exploitation in the wild, proof-of-concept exploits, or available mitigations and patches. Additionally, there are no details on any downstream impacts to third-party vendors or technology. See article

Oct 16, 2024 at 6:47 PM