CVE-2024-2628 — Use of Function with Inconsistent Implementations in Google Chrome

CWE-474 — Use of Function with Inconsistent Implementations7 documents7 sources

Severity

4.3MEDIUMNVD

EPSS

0.2%

top 60.36%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Google Chrome Chromium Fedoraproject Fedora

Timeline

PublishedMar 20

Description

Inappropriate implementation in Downloads in Google Chrome prior to 123.0.6312.58 allowed a remote attacker to perform UI spoofing via a crafted URL. (Chromium security severity: Medium)

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages3 packages

▶CVEListV5google/chrome123.0.6312.58 — 123.0.6312.58

▶NVDgoogle/chrome< 123.0.6312.58

▶Debianchromium/chromium< 123.0.6312.86-1~deb12u1+2

Also affects: Fedora 38, 39, 40

🔴Vulnerability Details

CVEList

CVE-2024-2628: Inappropriate implementation in Downloads in Google Chrome prior to 123↗2024-03-20

▶

OSV

CVE-2024-2628: Inappropriate implementation in Downloads in Google Chrome prior to 123↗2024-03-20

▶

GHSA

GHSA-7gwc-2cwp-3w9v: Inappropriate implementation in Downloads in Google Chrome prior to 123↗2024-03-20

▶

📋Vendor Advisories

Chrome

Stable Channel Update for Desktop: CVE-2024-2626↗2024-03-19

▶

Microsoft

Chromium: CVE-2024-2628 Inappropriate implementation in Downloads↗2024-03-12

▶

Debian

CVE-2024-2628: chromium - Inappropriate implementation in Downloads in Google Chrome prior to 123.0.6312.5...↗2024

▶