CVE-2024-4947

CriticalCVSS 9.6/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

Type Confusion in V8 in Google Chrome prior to 125.0.6422.60 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

Metrics

CVSS 3.1 9.6/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-843

Affected software

No affected versions have been published.

Timeline

Published: May 15, 2024
Last modified: Jun 17, 2026
Added to CISA KEV: May 20, 2024
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-49486.5Use after free in Dawn in Google Chrome prior to 125.0.6422.60 allowed a remote attacker to potentially exploit heap corruption via a crafte CVE-2024-49496.5Use after free in V8 in Google Chrome prior to 125.0.6422.60 allowed a remote attacker to potentially exploit heap corruption via a crafted CVE-2024-49506.5Inappropriate implementation in Downloads in Google Chrome prior to 125.0.6422.60 allowed a remote attacker who convinced a user to engage i CVE-2024-495015.7Sysmac Studio provided by OMRON Corporation contains an incorrect authorization vulnerability. If this vulnerability is exploited, an attack CVE-2024-495023.5A Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in the Setup Wizard, HTTP Proxy CVE-2024-495033.5A Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in SUSE manager allows attackers CVE-2024-495047.0grub2 allowed attackers with access to the grub shell to access files on the encrypted disks.CVE-2024-495056.1A Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in openSUSE Tumbleweed MirrorCache allo CVE-2024-495067.3Insecure creation of temporary files allows local users on systems with non-default configurations to cause denial of service or set the enc CVE-2024-495077.8InDesign Desktop versions ID18.5.2, ID19.5 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbit CVE-2024-495087.8InDesign Desktop versions ID18.5.2, ID19.5 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbit CVE-2024-495097.8InDesign Desktop versions ID18.5.3, ID19.5 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbit