CVE-2024-0804 — Protection Mechanism Failure in Google Chrome

CWE-693 — Protection Mechanism Failure7 documents7 sources

Severity

7.5HIGHNVD

EPSS

0.1%

top 70.18%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Google Chrome Chromium Fedoraproject Fedora

Timeline

PublishedJan 24

Description

Insufficient policy enforcement in iOS Security UI in Google Chrome prior to 121.0.6167.85 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages3 packages

▶CVEListV5google/chrome121.0.6167.85 — 121.0.6167.85

▶NVDgoogle/chrome< 121.0.6167.85

▶Debianchromium/chromium< 121.0.6167.85-1~deb12u1+2

Also affects: Fedora 38, 39

🔴Vulnerability Details

OSV

CVE-2024-0804: Insufficient policy enforcement in iOS Security UI in Google Chrome prior to 121↗2024-01-24

▶

GHSA

GHSA-m2r6-996j-pvf6: Insufficient policy enforcement in iOS Security UI in Google Chrome prior to 121↗2024-01-24

▶

CVEList

CVE-2024-0804: Insufficient policy enforcement in iOS Security UI in Google Chrome prior to 121↗2024-01-23

▶

📋Vendor Advisories

Chrome

Stable Channel Update for Desktop: CVE-2024-0805↗2024-01-23

▶

Microsoft

Chromium: CVE-2024-0804 Insufficient policy enforcement in iOS Security UI↗2024-01-09

▶

Debian

CVE-2024-0804: chromium - Insufficient policy enforcement in iOS Security UI in Google Chrome prior to 121...↗2024

▶