CVE-2024-6995 — Improperly Implemented Security Check for Standard in Google Chrome

CWE-358 — Improperly Implemented Security Check for Standard8 documents8 sources

Severity

4.7MEDIUMNVD

EPSS

0.1%

top 68.15%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Google Chrome Chromium Paloalto Prisma Browser

Timeline

PublishedAug 6

Latest updateAug 14

Description

Inappropriate implementation in Fullscreen in Google Chrome on Android prior to 127.0.6533.72 allowed a remote attacker who convinced a user to engage in specific UI gestures to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Medium)

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages4 packages

▶CVEListV5google/chrome127.0.6533.72 — 127.0.6533.72

▶NVDgoogle/chrome< 127.0.6533.72

▶Debianchromium/chromium< 127.0.6533.88-1~deb12u1+2

▶Palo Altopaloalto/prisma_browser

🔴Vulnerability Details

CVEList

CVE-2024-6995: Inappropriate implementation in Fullscreen in Google Chrome on Android prior to 127↗2024-08-06

▶

GHSA

GHSA-5w43-pfc6-5944: Inappropriate implementation in Fullscreen in Google Chrome on Android prior to 127↗2024-08-06

▶

OSV

CVE-2024-6995: Inappropriate implementation in Fullscreen in Google Chrome on Android prior to 127↗2024-08-06

▶

📋Vendor Advisories

Palo Alto

PAN-SA-2024-0007 Prisma Browser: Monthly Vulnerability Updates↗2024-08-14

▶

Chrome

Stable Channel Update for Desktop: CVE-2024-6994↗2024-07-23

▶

Microsoft

Chromium: CVE-2024-6995 Inappropriate implementation in Fullscreen↗2024-07-09

▶

Debian

CVE-2024-6995: chromium - Inappropriate implementation in Fullscreen in Google Chrome on Android prior to ...↗2024

▶