CVE-2024-0804: Insufficient policy enforcement in iOS Security UI

Reference Links

• https://chromereleases.googleblog.com/2024/01/stable-channel-update-for-desktop_23.html (Advisory)
• https://crbug.com/1515137
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-0804 (Advisory)
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MMI6GXFONZV6HE3BPZO3AP6GUVQLG4JQ/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VXDSGAFQD4BDB4IB2O4ZUSHC3JCVQEKC/

Parent vulnerabilities

(Appears in the following advisories)

• 2666430141006798223

Peer vulnerabilities

(Found alongside the following vulnerabilities)

• CVE-2024-3170
• CVE-2024-0807
• CVE-2024-0812
• CVE-2024-0808
• CVE-2024-3172
• CVE-2024-0810
• CVE-2024-0814
• CVE-2024-0813
• CVE-2024-0806
• CVE-2024-0805
• CVE-2024-0811
• CVE-2024-0809

Frequently Asked Questions

• What is the severity of CVE-2024-0804?

  CVE-2024-0804 has been classified with a severity rating reflecting its impact on user security in affected browsers.

• How do I fix CVE-2024-0804?

  To fix CVE-2024-0804, it is recommended to update Google Chrome to version 121.0.6167.85 or later, and ensure Microsoft Edge is similarly updated if using the Chromium-based version.

• Which software is affected by CVE-2024-0804?

  CVE-2024-0804 affects Google Chrome versions up to 121.0.6167.85 and Microsoft Edge versions up to 121.0.2277.83.

• Is there any alternative software to avoid CVE-2024-0804?

  Using alternative browsers that are not based on Chromium may minimize the risk from CVE-2024-0804 until a patch is applied.

• What does CVE-2024-0804 involve?

  CVE-2024-0804 involves insufficient policy enforcement, posing potential security risks to users.