CVE-2024-2887
Published: 26 March 2024
Summary
CVE-2024-2887 is a high-severity Type Confusion (CWE-843) vulnerability in Fedoraproject Fedora. Its CVSS base score is 7.7 (High).
Operationally, ranked in the top 7.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
CVE-2024-2887 is a type confusion vulnerability in the WebAssembly component of Google Chrome versions prior to 123.0.6312.86. The flaw carries a CVSS 3.1 score of 7.7 and is tracked under CWE-843.
A remote attacker can exploit the issue by serving a crafted HTML page to a victim, achieving arbitrary code execution within the browser process. The attack requires user interaction via the rendered page and involves high attack complexity under a local access vector.
Chrome stable channel updates released on 26 March 2024 address the vulnerability by correcting the type confusion in WebAssembly. Downstream distributions such as Fedora have issued corresponding package updates that pull in the patched Chrome release.
EPSS for the CVE rose from lower values to a peak of 0.1253 on 2026-05-22 before receding to the current score of 0.0876, indicating measurable post-disclosure exploitation interest.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-27831
Vulnerability details
Type Confusion in WebAssembly in Google Chrome prior to 123.0.6312.86 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.