CVE-2024-1283

Heap buffer overflow in Skia in Google Chrome prior to 121.0.6167.160 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page

High Β· published February 6, 2024

CVSS v3.1
8.8
EPSS
22%
Percentile
97.6
In the wild
Unconfirmed
What it is

🚨 A crafty heap buffer overflow in Skia can let attackers exploit your Chrome browser with just a specially designed HTML page! πŸ”₯ Think of it like a crowded restaurant where a waiter accidentally spills hot soup on the wrong customer β€” if the wrong person gets their hands on a seemingly harmless menu, chaos can unfold! 🍲 An attacker could inject malicious code and potentially control your browser, leading to unauthorized access of sensitive data, complete system compromise, or even a crash β€” absolutely devastating consequences for your online security! ⚑

Put simply

Think of it like a crowded restaurant where a waiter accidentally spills hot soup on the wrong customer β€” if the wrong person gets their hands on a seemingly harmless menu, chaos can unfold! 🍲 This vulnerability arises from a heap buffer overflow in Skia, the graphics library used by Chrome, allowing attackers to manipulate memory and execute arbitrary code by exploiting a crafted HTML page.

What to do

An attacker could inject malicious code and potentially control your browser, leading to unauthorized access of sensitive data, complete system compromise, or even a crash β€” absolutely devastating consequences for your online security! ⚑ To safeguard yourself, immediately update Google Chrome to version 121.0.6167.160 or later. Regularly check for updates to maintain your browser's security. Additionally, consider implementing browser security features like site isolation to further protect against such vulnerabilities. You've got this! By updating your browser today, you’re taking a heroic step to secure your digital space! πŸ¦Έβ€β™‚οΈ

The record
Technical detail
CVSS v3.1
8.8 Β· HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.21622 Β· 97.6th percentile
Published
2024-02-06T23:15Z
EPSS history
Timeline
  • 06 FEB 23:15Z
    Heap buffer overflow in Skia in Google Chrome prior to 121.0.6167.160 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page
    cvelistv5