CVE-2024-3838 — Improperly Implemented Security Check for Standard in Google Chrome

CWE-358 — Improperly Implemented Security Check for Standard6 documents6 sources
Severity
5.5MEDIUMNVD
EPSS
0.2%
top 55.96%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
5
Google ChromeChromiumDebian Chromium+2 more
Timeline
PublishedApr 17

Description

Inappropriate implementation in Autofill in Google Chrome prior to 124.0.6367.60 allowed an attacker who convinced a user to install a malicious app to perform UI spoofing via a crafted app. (Chromium security severity: Medium)

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:NExploitability: 1.8 | Impact: 3.6

Affected Packages6 packages

▶CVEListV5google/chrome124.0.6367.60 — 124.0.6367.60
▶NVDgoogle/chrome< 124.0.6367.60
▶debiandebian/chromium< chromium 124.0.6367.60-1~deb12u1 (bookworm)
▶Debianchromium/chromium< 124.0.6367.60-1~deb12u1+2

🔴Vulnerability Details

2
GHSA
GHSA-fff2-pwcg-x73m: Inappropriate implementation in Autofill in Google Chrome prior to 124↗2024-04-17
▶
OSV
CVE-2024-3838: Inappropriate implementation in Autofill in Google Chrome prior to 124↗2024-04-17
▶

📋Vendor Advisories

3
Chrome
Stable Channel Update for Desktop: CVE-2024-3838↗2024-04-16
▶
Microsoft
Chromium: CVE-2024-3838 Inappropriate implementation in Autofill↗2024-04-09
▶
Debian
CVE-2024-3838: chromium - Inappropriate implementation in Autofill in Google Chrome prior to 124.0.6367.60...↗2024
▶