CVE-2024-9369 is a critical vulnerability in Google Chrome's Mojo component (prior to version 129.0.6668.89) that allows a remote attacker to achieve an out-of-bounds memory write through a crafted HTML page, provided they have already compromised the renderer process. With a CVSS score of 9.6 (CRITICAL), this flaw has a high impact on confidentiality, integrity, and availability, requiring user interaction but enabling a complete system compromise. While the vulnerability is not currently listed in CISA's KEV catalog and no public exploit code (Metasploit, Nuclei, ExploitDB) is available, it has garnered some community discussion and media coverage, including mention in a Microsoft Patch Tuesday article.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 129.0.6668.89CPE matchmatch criteria | cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* | ||
>= 129.0.6668.89, < 129.0.6668.89CPE match | cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.8 Bluesky, 0.5 Mastodon, and 1.2 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.1 Security Researcher mentions.