CVE-2024-9955
Published: 15 October 2024
Summary
CVE-2024-9955 is a high-severity Use After Free (CWE-416) vulnerability in Google Chrome. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 3.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
The vulnerability is a use-after-free flaw (CWE-416) in the WebAuthentication component of Google Chrome versions prior to 130.0.6723.58. It can result in heap corruption when processing certain inputs and carries a CVSS 3.1 base score of 8.8.
A remote attacker can exploit the issue by persuading a user to visit a crafted HTML page, after which successful exploitation may allow arbitrary code execution within the renderer process.
The referenced Chrome stable-channel update and the associated Chromium bug tracker entry indicate that the issue is resolved in version 130.0.6723.58; users are advised to apply the update promptly.
The EPSS score has remained flat at 0.3350 with no observed climb after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-50237
Vulnerability details
Use after free in WebAuthentication in Google Chrome prior to 130.0.6723.58 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Use-after-free exploits that achieve arbitrary code execution are blocked or significantly hardened by non-executable pages and ASLR.