Log in Start free

Vulnerability · Published Aug 28, 2024 · Assigned by Chrome

CVE-2024-8193

High 8.8

In plain English

A high-severity heap buffer overflow in Chrome from Google. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.6%top 51.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC

Official description

Heap buffer overflow in Skia in Google Chrome prior to 128.0.6613.113 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8webkit2gtk32.54.0-1.el8_10ALSA-2026:74084
AlmaLinux:9webkit2gtk32.54.0-1.el9_8ALSA-2026:69098
AlmaLinux:8webkit2gtk3-devel2.54.0-1.el8_10ALSA-2026:74084
AlmaLinux:9webkit2gtk3-devel2.54.0-1.el9_8ALSA-2026:69098
AlmaLinux:8webkit2gtk3-jsc2.54.0-1.el8_10ALSA-2026:74084
AlmaLinux:9webkit2gtk3-jsc2.54.0-1.el9_8ALSA-2026:69098
AlmaLinux:8webkit2gtk3-jsc-devel2.54.0-1.el8_10ALSA-2026:74084
AlmaLinux:9webkit2gtk3-jsc-devel2.54.0-1.el9_8ALSA-2026:69098
Alpine:v3.21qt6-qtwebengine6.7.2-r4ALPINE-CVE-2024-8193
Alpine:v3.22qt6-qtwebengine6.7.2-r4ALPINE-CVE-2024-8193
Alpine:v3.23qt6-qtwebengine6.7.2-r4ALPINE-CVE-2024-8193
Alpine:v3.24qt6-qtwebengine6.7.2-r4ALPINE-CVE-2024-8193
Debian:12chromium128.0.6613.113-1~deb12u1DEBIAN-CVE-2024-8193
Debian:12chromium128.0.6613.113-1~deb12u1DSA-5761-1
Debian:13chromium128.0.6613.113-1DEBIAN-CVE-2024-8193
Debian:14chromium128.0.6613.113-1DEBIAN-CVE-2024-8193
Debian:12webkit2gtkno fix listedDEBIAN-CVE-2024-8193
Debian:13webkit2gtk2.54.0-1~deb13u1DEBIAN-CVE-2024-8193
Debian:14webkit2gtkno fix listedDEBIAN-CVE-2024-8193
Debian:12wpewebkitno fix listedDEBIAN-CVE-2024-8193
Debian:13wpewebkitno fix listedDEBIAN-CVE-2024-8193
Debian:14wpewebkit2.54.0-1DEBIAN-CVE-2024-8193
Rocky Linux:8webkit2gtk30:2.54.0-1.el8_10RLSA-2026:74084
Rocky Linux:9webkit2gtk30:2.54.0-1.el9_8RLSA-2026:69098
Ubuntu:26.04:LTSlibskiano fix listedUBUNTU-CVE-2024-8193
Ubuntu:26.10libskiano fix listedUBUNTU-CVE-2024-8193
Ubuntu:22.04:LTSqtwebkit-opensource-srcno fix listedUBUNTU-CVE-2024-8193
Ubuntu:24.04:LTSqtwebkit-opensource-srcno fix listedUBUNTU-CVE-2024-8193
Ubuntu:22.04:LTSwebkit2gtkno fix listedUBUNTU-CVE-2024-8193
Ubuntu:24.04:LTSwebkit2gtkno fix listedUBUNTU-CVE-2024-8193
Ubuntu:26.04:LTSwebkit2gtkno fix listedUBUNTU-CVE-2024-8193
Ubuntu:26.10webkit2gtkno fix listedUBUNTU-CVE-2024-8193
Ubuntu:22.04:LTSwpewebkitno fix listedUBUNTU-CVE-2024-8193

Affected products (as reported)

VendorProductVersions
Google Chrome 128.0.6613.113 – before 128.0.6613.113

Weakness: CWE-122 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References