CVE-2024-1672 — Use of Function with Inconsistent Implementations in Google Chrome

CWE-474 — Use of Function with Inconsistent Implementations8 documents7 sources

Severity

5.4MEDIUMNVD

EPSS

0.1%

top 71.54%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Google Chrome Chromium Fedoraproject Fedora

Timeline

PublishedFeb 21

Latest updateMar 19

Description

Inappropriate implementation in Content Security Policy in Google Chrome prior to 122.0.6261.57 allowed a remote attacker to bypass content security policy via a crafted HTML page. (Chromium security severity: Medium)

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.5

Affected Packages3 packages

▶CVEListV5google/chrome122.0.6261.57 — 122.0.6261.57

▶NVDgoogle/chrome< 122.0.6261.57

▶Debianchromium/chromium< 122.0.6261.57-1~deb12u1+2

Also affects: Fedora 38, 39

🔴Vulnerability Details

CVEList

CVE-2024-1672: Inappropriate implementation in Content Security Policy in Google Chrome prior to 122↗2024-02-21

▶

OSV

CVE-2024-1672: Inappropriate implementation in Content Security Policy in Google Chrome prior to 122↗2024-02-21

▶

GHSA

GHSA-q8f8-rhx9-2qm4: Inappropriate implementation in Content Security Policy in Google Chrome prior to 122↗2024-02-21

▶

📋Vendor Advisories

Chrome

Long Term Support Channel Update for ChromeOS: CVE-2024-1672↗2024-03-19

▶

Chrome

Stable Channel Update for Desktop: CVE-2024-3168↗2024-02-20

▶

Microsoft

Chromium: CVE-2024-1672 Inappropriate implementation in Content Security Policy↗2024-02-13

▶

Debian

CVE-2024-1672: chromium - Inappropriate implementation in Content Security Policy in Google Chrome prior t...↗2024

▶