Type Confusion in Google Chromium - CVE-2024-4058

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU88973

Type Confusion in Google Chromium - CVE-2024-4058

Published: April 24, 2024 / Updated: May 3, 2024


Vulnerability identifier: #VU88973
CSH Severity: High
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-4058
CWE-ID: CWE-843
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a type confusion error in ANGLE. A remote attacker can trick the victim to visit a specially crafted website, trigger a type confusion error and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


Affected software

Google Chromium
Microsoft Edge
Google Chrome
Gentoo Linux
Debian Linux
Fedora
Chrome OS
www-client/opera
dev-qt/qtwebengine
www-client/microsoft-edge
www-client/google-chrome
chromium
chromium (Debian package)
ww-client/microsoft-edge
www-client/chromium

How to mitigate CVE-2024-4058

Install updates from vendor's website.

Google Chromium - update to 124.0.6367.78
Microsoft Edge - update to 124.0.2478.67
Google Chrome - update to 124.0.6367.78
www-client/opera - update to 73.0.3856.284
dev-qt/qtwebengine - update to 103.0.5060.53
www-client/microsoft-edge - update to 110.0.5130.35
Chrome OS - update to 120.0.6099.309
www-client/google-chrome - update to 124.0.2478.97
chromium - addressed in versions 124.0.6367.78-1.el9, 124.0.6367.78-1.fc38, 124.0.6367.78-1.fc39, 124.0.6367.78-1.fc40, 124.0.6367.91-1.el9, 124.0.6367.91-1.fc40, 124.0.6367.118-1.el9, 124.0.6367.118-1.fc40, 124.0.6367.155-1.el9, 124.0.6367.201-1.el9, 125.0.6422.60-1.el9, 125.0.6422.76-1.el9
chromium (Debian package) - update to 124.0.6367.78-1~deb12u1
ww-client/microsoft-edge - update to 124.0.6367.155
www-client/chromium - update to 124.0.6367.155

External References

Related Security Bulletins