Log in Start free

Vulnerability · Published Jan 10, 2024 · Assigned by Chrome

CVE-2024-0333

Medium 5.3

In plain English

A medium-severity security flaw in Chrome from Google. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.4%top 61.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Insufficient data validation in Extensions in Google Chrome prior to 120.0.6099.216 allowed an attacker in a privileged network position to install a malicious extension via a crafted HTML page. (Chromium security severity: High)

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20qt5-qtwebengine5.15.16-r5ALPINE-CVE-2024-0333
Alpine:v3.21qt5-qtwebengine5.15.16-r5ALPINE-CVE-2024-0333
Alpine:v3.22qt5-qtwebengine5.15.16-r5ALPINE-CVE-2024-0333
Alpine:v3.23qt5-qtwebengine5.15.16-r5ALPINE-CVE-2024-0333
Alpine:v3.20qt6-qtwebengine6.6.1-r4ALPINE-CVE-2024-0333
Alpine:v3.21qt6-qtwebengine6.6.1-r4ALPINE-CVE-2024-0333
Alpine:v3.22qt6-qtwebengine6.6.1-r4ALPINE-CVE-2024-0333
Alpine:v3.23qt6-qtwebengine6.6.1-r4ALPINE-CVE-2024-0333
Alpine:v3.24qt6-qtwebengine6.6.1-r4ALPINE-CVE-2024-0333
Debian:12chromium120.0.6099.216-1~deb12u1DEBIAN-CVE-2024-0333
Debian:12chromium120.0.6099.216-1~deb12u1DSA-5598-1
Debian:13chromium120.0.6099.216-1DEBIAN-CVE-2024-0333
Debian:14chromium120.0.6099.216-1DEBIAN-CVE-2024-0333

Affected products (as reported)

VendorProductVersions
Google Chrome 120.0.6099.216 – before 120.0.6099.216

References