Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2024-0223: Chrome on Debian can be tricked into corrupting memory

CVE-2024-0223 · published 2 years ago

Summary

A specially crafted web page could cause Chrome on Debian (versions before 120.0.6099.199) to overwrite its own memory. This may let an attacker take control of the browser session. Update Chrome to version 120.0.6099.199 or newer to fix the issue.

What to do

Update debian chromium to version 120.0.6099.199-1~deb12u1.
Update debian chromium to version 120.0.6099.199-1.
Update google chrome to version 120.0.6099.199 or later.

Affected software

Ecosystem	Vendor	Product	Affected versions
Debian:12	debian	chromium	< 120.0.6099.199-1~deb12u1 Fix: upgrade to 120.0.6099.199-1~deb12u1
Debian:13	debian	chromium	< 120.0.6099.199-1 Fix: upgrade to 120.0.6099.199-1
Debian:14	debian	chromium	< 120.0.6099.199-1 Fix: upgrade to 120.0.6099.199-1
–	google	chrome	< 120.0.6099.199 `cpe:2.3:a:google:chrome::::::::`
–	fedoraproject	fedora	38 39 `cpe:2.3:o:fedoraproject:fedora:38:::::::*`

Original advisory text

Heap buffer overflow in ANGLE in Google Chrome prior to 120.0.6099.199 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

References

https://security-tracker.debian.org/tracker/CVE-2024-0223 Vendor Advisory
https://chromereleases.googleblog.com/2024/01/stable-channel-update-for-desktop.... Release Notes
https://crbug.com/1505009 Permissions Required Vendor Advisory
https://security.gentoo.org/glsa/202401-34
https://lists.fedoraproject.org/archives/list/[email protected]... Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/[email protected]... Mailing List Third Party Advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker partial control

Severity

8.8 High

Exploitation

10% chance of attack within 30 days

Type

CWE-787Out-of-bounds Write

Timeline

Published4 Jan 2024

Updated15 Oct 2026

First seen15 Sep 2026

Sources

DEBIAN-CVE-2024-0223 · OSV

CVE-2024-0223 · NVD

Track software like this

Free during beta