CVE-2024-7023 — Improper Input Validation in Google Chrome

CWE-20 — Improper Input Validation4 documents4 sources
Severity
8.8HIGHNVD
EPSS
0.7%
top 28.97%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Google Chrome
Timeline
PublishedSep 23
Latest updateSep 24

Description

Insufficient data validation in Updater in Google Chrome prior to 128.0.6537.0 allowed a remote attacker to perform privilege escalation via a malicious file. (Chromium security severity: Medium)

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages2 packages

▶CVEListV5google/chrome128.0.6537.0 — 128.0.6537.0
▶NVDgoogle/chrome< 128.0.6537.0

🔴Vulnerability Details

2
GHSA
GHSA-cwfh-p5vc-jcg4: Insufficient data validation in Updater in Google Chrome prior to 128↗2024-09-24
▶
CVEList
CVE-2024-7023: Insufficient data validation in Updater in Google Chrome prior to 128↗2024-09-23
▶

📋Vendor Advisories

1
Debian
CVE-2024-7023: chromium - Insufficient data validation in Updater in Google Chrome prior to 128.0.6537.0 a...↗2024
▶
CVE-2024-7023 — Improper Input Validation in Google | cvebase