CVE-2024-0805 — User Interface (UI) Misrepresentation of Critical Information in Google Chrome

CWE-451 — User Interface (UI) Misrepresentation of Critical Information7 documents7 sources

Severity

4.3MEDIUMNVD

EPSS

0.1%

top 66.98%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Google Chrome Chromium Fedoraproject Fedora

Timeline

PublishedJan 24

Description

Inappropriate implementation in Downloads in Google Chrome prior to 121.0.6167.85 allowed a remote attacker to perform domain spoofing via a crafted domain name. (Chromium security severity: Medium)

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages3 packages

▶CVEListV5google/chrome121.0.6167.85 — 121.0.6167.85

▶NVDgoogle/chrome< 121.0.6167.85

▶Debianchromium/chromium< 121.0.6167.85-1~deb12u1+2

Also affects: Fedora 38, 39

🔴Vulnerability Details

OSV

CVE-2024-0805: Inappropriate implementation in Downloads in Google Chrome prior to 121↗2024-01-24

▶

GHSA

GHSA-8r62-6w8q-xrq2: Inappropriate implementation in Downloads in Google Chrome prior to 121↗2024-01-24

▶

CVEList

CVE-2024-0805: Inappropriate implementation in Downloads in Google Chrome prior to 121↗2024-01-23

▶

📋Vendor Advisories

Chrome

Stable Channel Update for Desktop: CVE-2024-0805↗2024-01-23

▶

Microsoft

Chromium: CVE-2024-0805 Inappropriate implementation in Downloads↗2024-01-09

▶

Debian

CVE-2024-0805: chromium - Inappropriate implementation in Downloads in Google Chrome prior to 121.0.6167.8...↗2024

▶