CVE-2024-3840

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Insufficient policy enforcement in Site Isolation in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium)

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-285

Affected software

No affected versions have been published.

Timeline

Published: Apr 17, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-384017.8Memory corruption while processing concurrent IOCTL calls.CVE-2024-384027.8Memory corruption while processing IOCTL call for getting group info.CVE-2024-384036.5Transient DOS while parsing BTM ML IE when per STA profile is not included.CVE-2024-384047.5Transient DOS when registration accept OTA is received with incorrect ciphering key data IE in modem.CVE-2024-384056.5Transient DOS while processing the CU information from RNR IE.CVE-2024-384067.0Memory corruption while handling IOCTL calls in JPEG Encoder driver.CVE-2024-384077.0Memory corruption while processing input parameters for any IOCTL call in the JPEG Encoder driver.CVE-2024-384089.1Cryptographic issue when a controller receives an LMP start encryption command under unexpected conditions.CVE-2024-384097.8Memory corruption while station LL statistic handling.CVE-2024-38416.1Insufficient data validation in Browser Switcher in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to inject scripts or HTML CVE-2024-384107.8Memory corruption while IOCLT is called when device is in invalid state and the WMI command buffer may be freed twice.CVE-2024-384117.8Memory corruption while registering a buffer from user-space to kernel-space using IOCTL calls.