CVE-2024-9957: Use after free in UI

Q: What is the severity of CVE-2024-9957?

CVE-2024-9957 has been classified as a high severity vulnerability due to its potential impact on system security.

Q: How do I fix CVE-2024-9957?

To remediate CVE-2024-9957, users should update Google Chrome to version 130.0.6723.58 or later and ensure Microsoft Edge (Chromium-based) is also up-to-date.

Q: Which products are affected by CVE-2024-9957?

CVE-2024-9957 affects Google Chrome versions prior to 130.0.6723.58 and certain versions of Microsoft Edge (Chromium-based).

Q: When was CVE-2024-9957 first reported?

CVE-2024-9957 was first reported in October 2024 following updates made to the Chromium base.

Q: Is there a workaround for CVE-2024-9957?

There are no known workarounds for CVE-2024-9957, so it is recommended to apply the available updates.

Published Aug 8, 2024

Updated

Chromium: CVE-2024-9957 Use after free in UI

Other sources

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.

— Microsoft

Use after free in UI in Google Chrome on iOS prior to 130.0.6723.58 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)

— MITRE

Credit

lime@@limeSec_(TIANGONG Team of Legendsec at QI), fmyy@@binary_fmyy(TIANGONG Team of Legendsec at QI)

Affected Software

9 affected componentsFixes available

Microsoft Edge (Chromium-based)

Patch available

Microsoft Edge<130.0.2849.46

Google Chrome<130.0.6723.58

130.0.6723.58

All of the following

Google Chrome<130.0.6723.58

Apple iPhone OS

debian/chromium<130.0.6723.58-1~deb12u1

130.0.6723.58-1~deb12u1

debian/chromium<130.0.6723.58-1

130.0.6723.58-1

debian/chromium<130.0.6723.58-1

130.0.6723.58-1

debian/chromium

150.0.7871.100-1~deb12u1156.0.8078.79-1~deb12u1150.0.7871.181-1~deb13u1156.0.8078.79-1~deb13u1156.0.8078.79-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Google Chrome (Trace Event) to a version that resolves this vulnerability.
Fixed in 130.0.6723.58
Upgrade
Upgrade debian/chromium to a version that resolves this vulnerability.
Fixed in 130.0.6723.58-1~deb12u1
Upgrade
Upgrade debian/chromium to a version that resolves this vulnerability.
Fixed in 130.0.6723.58-1
Upgrade
Upgrade debian/chromium to a version that resolves this vulnerability.
Fixed in 150.0.7871.100-1~deb12u1Fixed in 156.0.8078.79-1~deb12u1Fixed in 150.0.7871.181-1~deb13u1Fixed in 156.0.8078.79-1~deb13u1Fixed in 156.0.8078.79-1
Upgrade
Upgrade Google Chrome on iOS to a version that resolves this vulnerability.
Fixed in 130.0.6723.58

Event History

Aug 8, 2024

CVE Published

12:00 AM

Oct 15, 2024

CVE Published

via MITRE·08:14 PM

Data Sourced

via MITRE·08:14 PM

DescriptionWeakness

Data Sourced

via OSV·09:15 PM

DescriptionSeverityAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

What is the severity of CVE-2024-9957?