CVE-2024-7964 is a high-severity use-after-free vulnerability affecting Google Chrome on Android versions prior to 128.0.6613.84, specifically within the password management component. A remote attacker could exploit this flaw by enticing a user to visit a specially crafted HTML page, potentially leading to heap corruption and significant impact. With a CVSS score of 8.8, this vulnerability carries high confidentiality, integrity, and availability impacts, requiring user interaction but no prior authentication. While no public exploit code or active exploitation is confirmed, its presence on the Hot List and recent media coverage indicate its importance.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 128.0.6613.84CPE matchmatch criteria | cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* | ||
>= 128.0.6613.84, < 128.0.6613.84CPE match | cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.1 Security Researcher mentions.