CVE-2024-4950: Inappropriate implementation in Downloads

Reference Links

• https://chromereleases.googleblog.com/2024/05/stable-channel-update-for-desktop_15.html (Advisory)
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-4950 (Advisory)
• https://issues.chromium.org/issues/40065403
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WSUWM73ZCXTN62AT2REYQDD5ZKPFMDZD/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NTSN22LNYXMWHVTYNOYQVOY7VDZFHENQ/

Parent vulnerabilities

(Appears in the following advisories)

• 6025264011428007699

Peer vulnerabilities

(Found alongside the following vulnerabilities)

• CVE-2024-4947
• CVE-2024-4948
• CVE-2024-4949

Frequently Asked Questions

• What is the severity of CVE-2024-4950?

  The severity of CVE-2024-4950 has not been explicitly rated, but it is a critical vulnerability that affects multiple browsers based on Chromium.

• How do I fix CVE-2024-4950?

  To fix CVE-2024-4950, update Google Chrome to version 125.0.6422.60 or later, or ensure your Microsoft Edge is updated with the latest security patches.

• Which software is affected by CVE-2024-4950?

  CVE-2024-4950 affects Google Chrome versions prior to 125.0.6422.60 and Microsoft Edge (Chromium-based) that relies on Chromium.

• What types of systems are impacted by CVE-2024-4950?

  CVE-2024-4950 impacts various operating systems running affected versions of Google Chrome and Edge, including Fedora 38, 39, and 40.

• Is there a known exploit for CVE-2024-4950?

  There are currently no publicly available exploits specifically linked to CVE-2024-4950 reported, but users should take immediate action to mitigate the risk.