HIGH
Use after free in WebCodecs in Google Chrome prior to 123.0.6312.86 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page
Published Mar 26, 2024
7.5
HIGHCVSS 3.1
EPSS 1.76%
Description
Use after free in WebCodecs in Google Chrome prior to 123.0.6312.86 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: High)
Affected products
-
Affected
- ≥ 123.0.6312.86, < 123.0.6312.86
Configuration 2
OR
- 38
- 39
- 40
-
Affected
- ≥ 40, < 1.fc40
-
Affected
- ≥ 0, < 123.0.6312.86
Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).
| Vendor | Product | Default status | Versions |
|---|---|---|---|
| Fedora Project | Fedora | unknown | Affected
|
| Chrome | unknown | Affected
|
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Weaknesses (1)
References (6)
- https://chromereleases.googleblog.com/2024/03/stable-channel-update-for-desktop_26.html Release Notes
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-27830 Advisory
- https://issues.chromium.org/issues/330575496 ExploitIssue Tracking
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3YUWGSMA5X2NQP5XEFCLRWNX6246GZ2C/ Mailing List
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/G3RKI7VTQSIAI3PVZGRCHOSELTQXQ5FQ/ Mailing List
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IQMRHKDEG4J7TMRRRGUGW6GS4MVBX5IT/ Mailing List
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner Chrome
Published Mar 26, 2024
Updated Mar 22, 2025
Reserved Mar 26, 2024
Link CVE-2024-2886
CISA Vulnrichment
Updated May 30, 2024
Red Hat
No data
GitHub
No data