CVE-2024-6777

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Use after free in Navigation in Google Chrome prior to 126.0.6478.182 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension. (Chromium security severity: High)

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-416

Affected software

Vendor	Product	Versions
Google	Chrome	>= 126.0.6478.182, < 126.0.6478.182
google	chrome	< 126.0.6478.182

References

https://chromereleases.googleblog.com/2024/07/stable-channel-update-for-desktop.htmlRelease Notes
https://issues.chromium.org/issues/345640549Exploit, Issue Tracking
https://chromereleases.googleblog.com/2024/07/stable-channel-update-for-desktop.htmlRelease Notes
https://issues.chromium.org/issues/345640549Exploit, Issue Tracking

Timeline

Published: Jul 16, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-67787.5Race in DevTools in Google Chrome prior to 126.0.6478.182 allowed an attacker who convinced a user to install a malicious extension to injec CVE-2024-67799.6Out of bounds memory access in V8 in Google Chrome prior to 126.0.6478.182 allowed a remote attacker to potentially perform a sandbox escape CVE-2024-67803.3Improper permission control in the mobile application (com.android.server.telecom) may lead to user information security risks.CVE-2024-67817.5Path traversal in Calibre <= 7.14.0 allow unauthenticated attackers to achieve arbitrary file read.CVE-2024-67829.8Improper access control in Calibre 6.9.0 ~ 7.14.0 allow unauthenticated attackers to achieve remote code execution.CVE-2024-67834.8A vulnerability has been discovered in Vue, that allows an attacker to perform XSS via prototype pollution. The attacker could change the pr CVE-2024-67849.9Server-Side Request Forgery vulnerabilities were found providing a potential for access to unauthorized resources and unintended information CVE-2024-67857.1The configuration file stores credentials in cleartext. An attacker with local access rights can read or modify the configuration file, pote CVE-2024-67866.5The vulnerability allows an attacker to craft MQTT messages that include relative path traversal sequences, enabling them to read arbitrary CVE-2024-67875.9This vulnerability occurs when an attacker exploits a race condition between the time a file is checked and the time it is used (TOCTOU). By CVE-2024-67889.8A remote unauthenticated attacker can use the firmware update feature on the LAN interface of the device to reset the password for the prede CVE-2024-67896.5A path traversal issue in API endpoint in M-Files Server before version 24.8.13981.0 and LTS 24.2.13421.15 SR2 and LTS 23.8.12892.0 SR6 allo