CVE-2024-5836

2024-06-1120:58:10

Chrome

github.com

inappropriate implementation

devtools

google chrome

arbitrary code execution

crafted chrome extension

high severity

AI Score

7.3

Confidence

Low

SSVC

Exploitation

none

Automatable

Technical Impact

total

JSON

Inappropriate Implementation in DevTools in Google Chrome prior to 126.0.6478.54 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code via a crafted Chrome Extension. (Chromium security severity: High)

CNA Affected

[
  {
    "vendor": "Google",
    "product": "Chrome",
    "versions": [
      {
        "status": "affected",
        "version": "126.0.6478.54",
        "lessThan": "126.0.6478.54",
        "versionType": "custom"
      }
    ]
  }
]

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*"
    ],
    "vendor": "google",
    "product": "chrome",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "126.0.6478.54",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "0",
        "lessThan": "126.0.6478.56",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "0",
        "lessThan": "126.0.6478.57",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unknown"
  }
]