KLA65692 Multiple vulnerabilities in Microsoft Browser

Multiple vulnerabilities were found in Microsoft Browser. Malicious users can exploit these vulnerabilities to obtain sensitive information, cause denial of service, bypass security restrictions, spoof user interface, execute arbitrary code.

Below is a complete list of vulnerabilities:

1. An information disclosure vulnerability in Microsoft Edge for Android (Chromium-based) can be exploited remotely to obtain sensitive information.
2. Policy enforcement vulnerability in Site Isolation can be exploited to cause denial of service.
3. Data validation vulnerability in Downloads can be exploited to cause denial of service.
4. Data validation vulnerability in Browser Switcher can be exploited to cause denial of service.
5. Implementation vulnerability in Autofill can be exploited to cause denial of service.
6. Object corruption vulnerability in V8 can be exploited to cause denial of service.
7. Object corruption vulnerability in WebAssembly can be exploited to cause denial of service.
8. Use after free vulnerability in V8 can be exploited to cause denial of service or execute arbitrary code.
9. Implementation vulnerability in Prompts can be exploited to cause denial of service.
10. An information disclosure vulnerability in Microsoft Edge (Chromium-based) can be exploited remotely to obtain sensitive information.
11. Policy enforcement vulnerability in WebUI can be exploited to cause denial of service.
12. Out of bounds read vulnerability in Fonts can be exploited to cause denial of service.
13. Implementation vulnerability in Network can be exploited to cause denial of service.
14. Implementation vulnerability in Extensions can be exploited to cause denial of service.
15. Use after free vulnerability in QUIC can be exploited to cause denial of service or execute arbitrary code.
16. Use after free vulnerability in Downloads can be exploited to cause denial of service or execute arbitrary code.

Original advisories

CVE-2024-29986

CVE-2024-3840

CVE-2024-3843

CVE-2024-3841

CVE-2024-3838

CVE-2024-3832

CVE-2024-3833

CVE-2024-3914

CVE-2024-3846

CVE-2024-29987

CVE-2024-3847

CVE-2024-3839

CVE-2024-3845

CVE-2024-3844

CVE-2024-3837

CVE-2024-3834

Related products

Microsoft-Edge

CVE list

CVE-2024-3838 unknown

CVE-2024-3844 unknown

CVE-2024-3837 unknown

CVE-2024-3846 unknown

CVE-2024-3832 unknown

CVE-2024-3843 unknown

CVE-2024-3847 unknown

CVE-2024-3914 unknown

CVE-2024-3845 unknown

CVE-2024-3841 unknown

CVE-2024-3833 unknown

CVE-2024-3840 unknown

CVE-2024-3839 unknown

CVE-2024-3834 unknown

CVE-2024-29986 high

CVE-2024-29987 high

Solution

Install necessary updates from the Settings and more menu, that are listed in your About Microsoft Edge page (Microsoft Edge About page usually can be accessed from the Help and feedback option)

Microsoft Edge update settings

Impacts

• ACE

Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.

• OSI

Obtain sensitive information. Exploitation of vulnerabilities with this impact can lead to capturing by abuser information, critical for user or system.

• DoS

Denial of service. Exploitation of vulnerabilities with this impact can lead to loss of system availability or critical functional fault.

• SB

Security bypass. Exploitation of vulnerabilities with this impact can lead to performing actions restricted by current security settings.

• SUI

Spoof user interface. Exploitation of vulnerabilities with this impact can lead to changes in user interface to beguile user into inaccurate behavior.

Affected Products

• Microsoft Edge (Chromium-based)