CVE-2024-2631 — User Interface (UI) Misrepresentation of Critical Information in Google Chrome

CWE-451 — User Interface (UI) Misrepresentation of Critical Information7 documents7 sources

Severity

4.3MEDIUMNVD

EPSS

0.2%

top 62.33%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Google Chrome Chromium Fedoraproject Fedora

Timeline

PublishedMar 20

Description

Inappropriate implementation in iOS in Google Chrome prior to 123.0.6312.58 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages3 packages

▶CVEListV5google/chrome123.0.6312.58 — 123.0.6312.58

▶NVDgoogle/chrome< 123.0.6312.58

▶Debianchromium/chromium< 123.0.6312.86-1~deb12u1+2

Also affects: Fedora 38, 39, 40

🔴Vulnerability Details

GHSA

GHSA-xp9q-8p95-j7cm: Inappropriate implementation in iOS in Google Chrome prior to 123↗2024-03-20

▶

OSV

CVE-2024-2631: Inappropriate implementation in iOS in Google Chrome prior to 123↗2024-03-20

▶

CVEList

CVE-2024-2631: Inappropriate implementation in iOS in Google Chrome prior to 123↗2024-03-20

▶

📋Vendor Advisories

Chrome

Stable Channel Update for Desktop: CVE-2024-2629↗2024-03-19

▶

Microsoft

Chromium: CVE-2024-2631 Inappropriate implementation in iOS↗2024-03-12

▶

Debian

CVE-2024-2631: chromium - Inappropriate implementation in iOS in Google Chrome prior to 123.0.6312.58 allo...↗2024

▶