CVE-2024-4058
Published: 01 May 2024
Summary
CVE-2024-4058 is a high-severity Type Confusion (CWE-843) vulnerability in Google Chrome. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 7.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
The vulnerability is a type confusion flaw, tracked as CWE-843, in the ANGLE component of Google Chrome versions prior to 124.0.6367.78. The issue carries a CVSS 3.1 score of 8.8 and was rated Critical by the Chromium project; successful exploitation can result in heap corruption when processing specially crafted content.
A remote attacker can trigger the flaw by convincing a user to visit a malicious HTML page, after which the attacker may achieve arbitrary code execution or other impacts affecting confidentiality, integrity, and availability without requiring user privileges beyond normal web browsing.
Chrome stable-channel release notes and the associated Chromium bug tracker entries state that the issue is resolved by upgrading to version 124.0.6367.78 or later; downstream distributions such as Fedora have published corresponding package updates to apply the same fix.
The EPSS score has remained flat at 0.0910 with no material increase since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-32623
Vulnerability details
Type confusion in ANGLE in Google Chrome prior to 124.0.6367.78 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.