CVE-2024-7017

HighCVSS 7.5/10Last modified Oct 2, 2026

Description

Inappropriate implementation in DevTools in Google Chrome prior to 126.0.6478.182 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-362

Affected software

Vendor	Product	Versions
Google	Chrome	>= 126.0.6478.182, < 126.0.6478.182

References

https://chromereleases.googleblog.com/2024/07/stable-channel-update-for-desktop.htmlRelease Notes, Vendor Advisory
https://issues.chromium.org/issues/338248595Exploit, Issue Tracking, Third Party Advisory

Timeline

Published: Nov 14, 2025
Last modified: Oct 2, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-70187.8Heap buffer overflow in PDF in Google Chrome prior to 124.0.6367.78 allowed a remote attacker to potentially exploit heap corruption via a c CVE-2024-70194.3Inappropriate implementation in UI in Google Chrome prior to 124.0.6367.60 allowed a remote attacker who convinced a user to engage in speci CVE-2024-70204.3Inappropriate implementation in Autofill in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to perform UI spoofing via a craf CVE-2024-70214.3Inappropriate implementation in Autofill in Google Chrome on Windows prior to 124.0.6367.60 allowed a remote attacker to perform UI spoofing CVE-2024-70224.3Uninitialized Use in V8 in Google Chrome prior to 123.0.6312.58 allowed a remote attacker to perform out of bounds memory access via a craft CVE-2024-70238.8Insufficient data validation in Updater in Google Chrome prior to 128.0.6537.0 allowed a remote attacker to perform privilege escalation via CVE-2024-70249.6Inappropriate implementation in V8 in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to potentially perform a sandbox escape CVE-2024-70258.8Integer overflow in Layout in Google Chrome prior to 129.0.6668.89 allowed a remote attacker to potentially exploit heap corruption via a cr CVE-2024-70267.5Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Teknogis Informatics Closed Circuit Ve CVE-2024-70277.3The WooCommerce - PDF Vouchers plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 4.9.3. This is CVE-2024-70299.8Commands can be injected over the network and executed without authentication.CVE-2024-70304.3The Smart Online Order for Clover plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check