Improper access control in Google Chrome - CVE-2024-6993

Vulnerability identifier: #VU94695

CSH Severity: High

CVSS v4 BT: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2024-6993

CWE-ID: CWE-284

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to inappropriate implementation in Canvas. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain unauthorized access to the system.

Google Chrome
Microsoft Edge
Debian Linux
Fedora
chromium
chromium (Debian package)

Install updates from vendor's website.

Google Chrome - update to 127.0.6533.72
Microsoft Edge - update to 127.0.2651.74
chromium - addressed in versions 127.0.6533.72-1.el8, 127.0.6533.72-1.el9, 127.0.6533.72-1.fc39, 127.0.6533.72-1.fc40, 127.0.6533.88-2.el8, 127.0.6533.88-2.el9, 127.0.6533.88-2.fc40
chromium (Debian package) - update to 127.0.6533.88-1~deb12u1

• https://chromereleases.googleblog.com/2024/07/stable-channel-update-for-desktop_23.html
• https://issues.chromium.org/issues/349903568

• Multiple vulnerabilities in Google Chrome
• Multiple vulnerabilities in Microsoft Edge
• Debian update for chromium
• Fedora 40 update for chromium
• Fedora EPEL 8 update for chromium
• Fedora EPEL 9 update for chromium
• Fedora 40 update for chromium
• Fedora EPEL 8 update for chromium
• Fedora 39 update for chromium
• Fedora EPEL 9 update for chromium