CVE-2024-9956 — Improper Privilege Management in Google Chrome

10 documents10 sources
Severity
7.8HIGHNVD
EPSS
0.0%
top 94.53%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Google ChromeChromiumPaloalto Prisma Browser
Timeline
PublishedOct 15
Latest updateJan 27

Description

Inappropriate implementation in WebAuthentication in Google Chrome on Android prior to 130.0.6723.58 allowed a local attacker to perform privilege escalation via a crafted HTML page. (Chromium security severity: Medium)

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages4 packages

▶CVEListV5google/chrome130.0.6723.58 — 130.0.6723.58
▶NVDgoogle/chrome< 130.0.6723.58
▶Debianchromium/chromium< 130.0.6723.58-1~deb12u1+2

🔴Vulnerability Details

3
OSV
CVE-2024-9956: Inappropriate implementation in WebAuthentication in Google Chrome on Android prior to 130↗2024-10-15
▶
CVEList
CVE-2024-9956: Inappropriate implementation in WebAuthentication in Google Chrome on Android prior to 130↗2024-10-15
▶
GHSA
GHSA-w2p9-j475-2wp5: Inappropriate implementation in WebAuthentication in Google Chrome on Android prior to 130↗2024-10-15
▶

📋Vendor Advisories

5
Apple
CVE-2024-9956: iOS 18.3 and iPadOS 18.3↗2025-01-27
▶
Palo Alto
PAN-SA-2024-0016 Chromium: Monthly Vulnerability Updates↗2024-11-13
▶
Microsoft
Chromium: CVE-2024-9956 Inappropriate implementation in Web Authentication↗2024-10-08
▶
Debian
CVE-2024-9956: chromium - Inappropriate implementation in WebAuthentication in Google Chrome on Android pr...↗2024
▶
Mozilla
Mozilla Foundation Security Advisory 2025-14: CVE-2024-9956↗
▶

💬Community

1
Bugzilla
A vulnerability in Firefox mobile allows attackers to trigger fido:/ links, hijacking FIDO2 accounts by tricking victims into authenticating malicious requests, bypassing 2FA, and taking over accounts↗2024-10-02
▶
CVE-2024-9956 — Improper Privilege Management in Google | cvebase