CVE-2024-3176

CVE-2024-3176 affects Google Chrome with an out-of-bounds write in SwiftShader triggered by a crafted HTML page, enabling remote memory corruption. Chrome versions prior to 117.0.5938.62 are vulnerable; upgrade to 117.0.5938.62 or later to mitigate. Other connected sources corroborate the same Ch...

CVE-2019-25154

The CVE-2019-25154 entry describes an Inappropriate implementation in iframe handling in Google Chrome prior to 77.0.3865.75, which could allow a remote attacker to potentially perform a sandbox escape via a crafted HTML page. Affected software is Google Chrome (Chromium-based); the underlying is...

CVE-2020-36765

CVE-2020-36765 affects Google Chrome (

CVE-2024-3175

CVE-2024-3175 concerns insufficient data validation in the Chrome Extensions component, enabling privilege escalation via a crafted Chrome Extension. The primary documentation states vulnerable component as Extensions, with affected Chrome versions before 120.0.6099.62 (remediation: update to 120...

CVE-2024-3173

The CVE-2024-3173 entry describes an insufficient data validation in Chrome’s Updater, enabling OS‑level privilege escalation via a malicious file prior to Chrome 120.0.6099.62. Affected component: Updater in Google Chrome (Chromium). Root cause: insufficient input validation in updater workflow....

CVE-2024-3172

CVE-2024-3172 concerns Insufficient data validation in DevTools of Google Chrome prior to 121.0.6167.85. A remote attacker could trick a user into UI gestures to execute arbitrary code via a crafted HTML page. Affected software: Google Chrome (DevTools). Root cause: input/data validation gaps in ...

CVE-2023-7013

CVE-2023-7013 affects Google Chrome’s Compositing component. The vulnerability arises from an inappropriate implementation that could allow a remote attacker to spoof the security UI via a crafted HTML page. Affected software is Chrome; root cause is within the Compositing path leading to UI spoo...

CVE-2024-2884

CVE-2024-2884 describes an out-of-bounds read in V8 (Chrome’s JavaScript engine) that could be triggered by a crafted HTML page. Affected product: Google Chrome (Linux/Mac/Windows) with versions prior to 121.0.6167.139. Root cause is an out-of-bounds memory access in V8, allowing remote attackers...

CVE-2024-34724

CVE-2024-34724 describes a race condition in the kernel function _UnrefAndMaybeDestroy (pmr.c) that can enable arbitrary code execution and local escalation of privilege without user interaction. The vulnerability is rooted in race timing within memory/reference handling, allowing a local attacke...

CVE-2024-34726

The CVE-2024-34726 issue is in PVRSRV_MMap (pvr_bridge_k.c) of the PVR bridge kernel module. A logic error in PVRSRV_MMap can allow arbitrary code execution, enabling local kernel escalation of privilege with no extra execution privileges and without user interaction. The available documents do n...

CVE-2024-34721

CVE-2024-34721 describes an information-disclosure in Android’s MediaProvider.java, in ensureFileColumns, where improper input validation may allow a user to disclose files owned by another user. This is a local disclosure with no extra execution privileges required and does not require user inte...

CVE-2024-34722

CVE-2024-34722 is an Android BLE legacy-pairing authentication bypass caused by an incorrect protocol implementation in smp_proc_rand of smp_act.cc. The issue enables remote elevation of privilege with no extra privileges or user interaction, as described across multiple sources (NVD, Red Hat CVE...

CVE-2024-31320

CVE-2024-31320 relates to Android’s setSkipPrompt in AssociationRequest.java, where an attacker could establish a companion device association without user confirmation, enabling local elevation of privilege with no user interaction. The Red Hat and CNVD entries align on an Android elevation-of-p...

CVE-2024-31335

The CVE-2024-31335 entry concerns a logic error in DevmemIntChangeSparse2 within devicemem_server.c that can enable arbitrary code execution with local privilege elevation in the kernel. Connected sources indicate affected components include Android’s kernel-related stack and PowerVR-GPU subcompo...

CVE-2024-31332

CVE-2024-31332 affects Google Android Framework components, where a missing permission check allows bypassing restrictions on adding new Wi‑Fi connections. This enables local elevation of privilege with no extra execution privileges and no user interaction. Root cause: permission check gaps in mu...

CVE-2024-31324

CVE-2024-31324 affects Android Framework due to a tapjacking/overlay bypass in WindowState.java. The issue can be triggered by starting an activity in portrait, then rotating to landscape, enabling local elevation of privilege with user interaction required. The entry notes exploitation is possib...

CVE-2024-31319

CVE-2024-31319 affects Android Framework (NotificationManagerService.java). A cross-user data leak caused by a confused deputy could lead to local escalation of privilege with no extra execution privileges required. Exploitation is described as local and independent of user interaction. Public de...

CVE-2024-31318

CVE-2024-31318 affects Android’s CompanionDeviceManagerService.java. The flaw is a missing permission check that could allow pairing a companion device without user acceptance, enabling local elevation of privilege with no extra execution privileges required. User interaction is not needed for ex...

CVE-2024-31325

CVE-2024-31325 is listed in the Android Framework as an Elevation of Privilege (EoP) vulnerability with a local attack vector. The issue arises from a logic error that can reveal images across different users’ data, enabling local privilege escalation without additional execution privileges. Affe...

CVE-2024-31322

Summary of CVE-2024-31322 : In Android’s AccessibilityManagerService.updateServicesLocked, improper input validation can let an app be hidden from Settings while still retaining the Accessibility Service, enabling local elevation of privilege with no extra execution privileges required. Exploitat...