PT-2024-2545 · Microsoft+6 · Edge+6

Manfred Paul · Published 2024-03-26 · Updated 2025-12-15 · CVE-2024-2887

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions

Google Chrome versions prior to 123.0.6312.86 Microsoft Edge (Chromium-based) versions prior to 123.0.6312.86 Chromium versions prior to 126.0.6478.182-alt0.p10.1 nodejs-electron-28.2.10-1.1 chromedriver-124.0.6367.201-1.1 OpenSUSE (affected versions not specified) MosOS (affected versions not specified) Debian (affected versions not specified)

Description

A type confusion vulnerability exists in the WebAssembly (WASM) module of Google Chrome and Microsoft Edge (Chromium). This flaw allows a remote attacker to execute arbitrary code via a crafted HTML page. The vulnerability stems from improper input validation within the WASM module decoder, specifically a missing check of the type section size during the DecodeTypeSection process.

Recommendations

Google Chrome versions prior to 123.0.6312.86: Upgrade to version 123.0.6312.86 or later. Microsoft Edge (Chromium-based) versions prior to 123.0.6312.86: Upgrade to version 123.0.6312.86 or later. Chromium versions prior to 126.0.6478.182-alt0.p10.1: Upgrade to version 126.0.6478.182-alt0.p10.1 or later. nodejs-electron-28.2.10-1.1: Upgrade to the latest available version. chromedriver-124.0.6367.201-1.1: Upgrade to the latest available version. OpenSUSE: Upgrade your Chromium packages to the latest available version. Debian: Upgrade your Chromium packages to version 123.0.6312.86-1~deb12u1 or later.

Exploit

Fix

RCE

Type Confusion

Weakness Enumeration

CWE-843

Related Identifiers

ALSA-2025_16880

ALT-PU-2024-10294

ALT-PU-2024-14286

ALT-PU-2024-14830

ALT-PU-2024-4642

ALT-PU-2024-7309

BDU:2024-02532

CVE-2024-2887

DSA-5648-1

OPENSUSE-SU-2024:0122-1

OPENSUSE-SU-2024:13846-1

OPENSUSE-SU-2024:13953-1

OPENSUSE-SU-2024_0122-1

ZDI-24-366

Affected Products

Alt Linux

Astra Linux

Debian

Google Chrome

Edge

Red Os

Suse

References · 118

• 🔥 https://github.com/rycbar77/CVE-2024-2887 · Exploit
• 🔥 https://github.com/PumpkinBridge/Chrome-CVE-2024-2887-RCE-POC · Exploit
• 🔥 https://issues.chromium.org/issues/330588502 · Exploit
• 🔥 https://zerodayinitiative.com/blog/2024/5/2/cve-2024-2887-a-pwn2own-winning-bug-in-google-chrome · Exploit
• https://zerodayinitiative.com/advisories/ZDI-24-366 · Security Note
• https://bdu.fstec.ru/vul/2024-02532 · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/G3RKI7VTQSIAI3PVZGRCHOSELTQXQ5FQ · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:0122-1 · Vendor Advisory
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-2887 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20241017SE16 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-2887 · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/706375 · Security Note
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/3YUWGSMA5X2NQP5XEFCLRWNX6246GZ2C · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:13846-1 · Vendor Advisory