PT-2024-3005 · Google+4 · Google Chrome+4

Darknavy

·

Published

2024-04-01

·

Updated

2024-12-19

·

CVE-2024-3157

CVSS v2.0

10

Critical

VectorAV:N/AC:L/Au:N/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 123.0.6312.122
Description The issue is related to out of bounds memory access in Compositing, allowing a remote attacker who has compromised the GPU process to potentially perform a sandbox escape via specific UI gestures. This could enable the attacker to execute arbitrary code using a specially crafted web page.
Recommendations For Google Chrome versions prior to 123.0.6312.122, update to version 123.0.6312.122 or later to resolve the issue. As a temporary workaround, consider restricting access to the Compositing component until a patch is applied. Avoid using specific UI gestures that could trigger the vulnerable code.

Exploit

Fix

Memory Corruption

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-787

Related Identifiers

ALT-PU-2024-10294
ALT-PU-2024-14286
ALT-PU-2024-14830
ALT-PU-2024-6499
ALT-PU-2024-7309
BDU:2024-03187
CVE-2024-3157
DSA-5656-1
MGASA-2024-0150
OPENSUSE-SU-2024:13953-1
OPENSUSE-SU-2024:14548-1

Affected Products

Alt Linux
Astra Linux
Debian
Google Chrome
Red Os