CVE-2024-3846

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Inappropriate implementation in Prompts in Google Chrome prior to 124.0.6367.60 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Affected software

VendorProductVersions
GoogleChrome>= 124.0.6367.60, < 124.0.6367.60
googlechrome124.0.6367.60

References

Timeline

Published
Apr 17, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-384606.5In SonarQube before 10.4 and 9.9.4 LTA, encrypted values generated using the Settings Encryption feature are potentially exposed in cleartexCVE-2024-384617.5irodsServerMonPerf in iRODS before 4.3.2 attempts to proceed with use of a path even if it is not a directory.CVE-2024-384629.8iRODS before 4.3.2 provides an msiSendMail function with a problematic dependency on the mail binary, such as in the mailMS.cpp#L94-L106 refCVE-2024-384655.3Shenzhen Guoxin Synthesis image system before 8.3.0 allows username enumeration because of the response discrepancy of incorrect versus erroCVE-2024-384669.8Shenzhen Guoxin Synthesis image system before 8.3.0 has a 123456Qw default password.CVE-2024-384677.5Shenzhen Guoxin Synthesis image system before 8.3.0 allows unauthorized user information retrieval via the queryUser API.CVE-2024-384689.8Shenzhen Guoxin Synthesis image system before 8.3.0 allows unauthorized password resets via the resetPassword API.CVE-2024-384696.3zhimengzhe iBarn v1.5 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the $search parameter at /pay.php.CVE-2024-38476.1Insufficient policy enforcement in WebUI in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to bypass content security policyCVE-2024-384706.1zhimengzhe iBarn v1.5 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the $search parameter at /own.php.CVE-2024-384716.8Multiple TP-LINK products allow a network-adjacent attacker with an administrative privilege to execute arbitrary OS commands by restoring aCVE-2024-384727.5SSRF in Apache HTTP Server on Windows allows to potentially leak NTLM hashes to a malicious server via SSRF and malicious requests or conten
CVE-2024-3846: Medium severity, CVSS 4.3 | Vulnix