CVE-2024-6778 — Race Condition in Google Chrome

CWE-362 — Race ConditionCWE-366 — Race Condition within a ThreadCWE-357 — Insufficient UI Warning of Dangerous OperationsCWE-449 — The UI Performs the Wrong Action15 documents8 sources
Severity
7.5HIGHNVD
EPSS
12.8%
top 5.98%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
6
Google ChromeChromiumDebian Chromium+3 more
Timeline
PublishedJul 16
Latest updateDec 10

Description

Race in DevTools in Google Chrome prior to 126.0.6478.182 allowed an attacker who convinced a user to install a malicious extension to inject scripts or HTML into a privileged page via a crafted Chrome Extension. (Chromium security severity: High)

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 1.6 | Impact: 5.9

Affected Packages7 packages

▶CVEListV5google/chrome126.0.6478.182 — 126.0.6478.182
▶NVDgoogle/chrome< 126.0.6478.182
▶debiandebian/chromium< chromium 126.0.6478.182-1~deb12u1 (bookworm)
▶Debianchromium/chromium< 126.0.6478.182-1~deb12u1+2

🔴Vulnerability Details

2
GHSA
GHSA-9m98-937v-r97x: Race in DevTools in Google Chrome prior to 126↗2024-07-17
▶
OSV
CVE-2024-6778: Race in DevTools in Google Chrome prior to 126↗2024-07-16
▶

📋Vendor Advisories

11
Microsoft
Chromium: CVE-2024-12692 Type Confusion in V8↗2024-12-10
▶
Microsoft
Chromium: CVE-2024-12053 Type Confusion in V8↗2024-12-10
▶
Microsoft
Chromium: CVE-2024-12693 Out of bounds memory access in V8↗2024-12-10
▶
Microsoft
Microsoft Edge (Chromium-based) Spoofing Vulnerability↗2024-12-10
▶
Microsoft
Chromium: CVE-2024-12695 Out of bounds write in V8↗2024-12-10
▶

📄Research Papers

1
arXiv
Microservice Vulnerability Analysis: A Literature Review with Empirical Insights↗2024-07-31
▶