CVE-2024-4558

high-risk

Published 2024-05-07

Use after free in ANGLE in Google Chrome prior to 124.0.6367.155 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Do I need to act?

2.4% chance of exploitation in next 30 days

EPSS score — moderate exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 9.6/10 Critical

NETWORK / LOW complexity

Affected Products (8)

Chrome

Fedora

Safari

Ipados

Iphone Os

Macos

Affected Vendors

Apple Google Fedoraproject

References (24)

Mailing List http://seclists.org/fulldisclosure/2024/Jul/15

Mailing List http://seclists.org/fulldisclosure/2024/Jul/16

Mailing List http://seclists.org/fulldisclosure/2024/Jul/18

Release Notes https://chromereleases.googleblog.com/2024/05/stable-channel-update-for-desktop_...

Exploit https://issues.chromium.org/issues/337766133

Mailing List https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproje...

Mailing List http://seclists.org/fulldisclosure/2024/Jul/15

Mailing List http://seclists.org/fulldisclosure/2024/Jul/16

Mailing List http://seclists.org/fulldisclosure/2024/Jul/18

Release Notes https://chromereleases.googleblog.com/2024/05/stable-channel-update-for-desktop_...

Exploit https://issues.chromium.org/issues/337766133

https://lists.debian.org/debian-lts-announce/2024/09/msg00006.html

Mailing List https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproje...

and 4 more references

/ 100

high-risk

Severity 32/34 · Critical

Exploitability 5/34 · Minimal

Exposure 14/34 · Moderate