Use After Free Vulnerability in Google Chrome
CVE-2024-9955

8.8HIGH

Key Information:

Vendor
Google
Status
Chrome
Vendor
CVE Published:
15 October 2024

Badges

👾 Exploit Exists🟡 Public PoC

Summary

A use after free vulnerability exists in the WebAuthentication component of Google Chrome that may allow an attacker to exploit heap corruption. This vulnerability is triggered by sending a specially crafted HTML page to a user, potentially affecting the integrity of the browser session. Users are encouraged to update to the latest version to mitigate risks associated with this vulnerability.

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2024-9955-POC
Created by amfg145

References

https://chromereleases.googleblog.com/2024/10/stable-chan...
https://issues.chromium.org/issues/370133761

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

Collectors

NVD DatabaseGoogle Feed1 Proof of Concept(s)
.