CVE-2024-3841

2024-04-1708:15:10

CWE-20

Chrome

web.nvd.nist.gov

data validation

google chrome

browser switcher

remote attack

script injection

CVSS3

7.6

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

HIGH

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L

AI Score

5.3

Confidence

Low

EPSS

Percentile

13.0%

JSON

Insufficient data validation in Browser Switcher in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to inject scripts or HTML into a privileged page via a malicious file. (Chromium security severity: Medium)

Affected configurations

Vulners

Vulnrichment

Node

googlechromeRange<124.0.6367.60

VendorProductVersionCPE
googlechrome*cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
google	chrome	*	cpe:2.3:a:google:chrome::::::::

CNA Affected

[
  {
    "vendor": "Google",
    "product": "Chrome",
    "versions": [
      {
        "version": "124.0.6367.60",
        "status": "affected",
        "lessThan": "124.0.6367.60",
        "versionType": "custom"
      }
    ]
  }
]