Cyber Resilience

CVE-2024-9964

Medium

Published: 15 October 2024

Published
15 October 2024
Modified
25 March 2025
KEV Added
—
Patch
—
CVSS Score v3.1 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
EPSS Score 0.0013 31.8th percentile
Risk Priority 9 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-9964 is a medium-severity an unspecified weakness vulnerability in Google Chrome. Its CVSS base score is 4.3 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Browser Extensions (T1176.001); ranked at the 31.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

Inappropriate implementation in Payments in Google Chrome prior to 130.0.6723.58 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted Chrome Extension. (Chromium security severity: Low)

CWE(s)
NVD-CWE-noinfo

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1176.001 Browser Extensions Persistence
Adversaries may abuse internet browser extensions to establish persistent access to victim systems.
attack.mitre.org →
T1657 Financial Theft Impact
Adversaries may steal monetary resources from targets through extortion, social engineering, technical theft, or other methods aimed at their own financial gain at the expense of the availability of these resources for victims.
attack.mitre.org →
Why these techniques?

The vulnerability enables crafted Chrome extensions to spoof the Payments UI through specific user gestures, facilitating browser extension abuse (T1176.001) for financial theft (T1657) by tricking users into entering payment details or authorizing transactions.

Affected Assets

google
chrome
≤ 130.0.6723.58

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References