CVE-2024-3157

Out of bounds memory access in Compositing in Google Chrome prior to 123.0.6312.122 allowed a remote attacker who had compromised the GPU process to…

High · published April 10, 2024

CVSS v3.1
8.1
EPSS
1%
Percentile
57.7
In the wild
Unconfirmed
What it is

⚡ An out-of-bounds memory access in Google Chrome could let a remote attacker escape the sandbox, and all it takes is some crafty UI gestures! 🔥 Think of it like a magician who distracts the audience with a fancy trick while slipping out of a locked room — seemingly contained, but with the right moves, they can break free! If an attacker successfully exploits this vulnerability, they could bypass the protective boundaries of the browser and gain access to sensitive areas of the system. This means sneaky access to data or even the potential to execute malicious commands, putting your entire device and data at risk.

Put simply

Think of it like a magician who distracts the audience with a fancy trick while slipping out of a locked room — seemingly contained, but with the right moves, they can break free! This vulnerability arises from improper handling of memory within the Compositing process of Google Chrome, allowing attackers with control over the GPU process to exploit it using specific user interface gestures, resulting in a possible sandbox escape.

What to do

If an attacker successfully exploits this vulnerability, they could bypass the protective boundaries of the browser and gain access to sensitive areas of the system. This means sneaky access to data or even the potential to execute malicious commands, putting your entire device and data at risk. Update Google Chrome to version 123.0.6312.122 or later to patch this vulnerability immediately. Regularly check for updates and ensure all users are running the latest version to maintain security. You've got this! Follow these steps and you'll shield your system from this sneaky vulnerability! 🛡️

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00848 · 57.7th percentile
Published
2024-04-10T18:41Z
EPSS history
Timeline
  • 10 APR 18:41Z
    Out of bounds memory access in Compositing in Google Chrome prior to 123.0.6312.122 allowed a remote attacker who had compromised the GPU process to…
    cvelistv5