CVE-2024-7025

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Integer overflow in Layout in Google Chrome prior to 129.0.6668.89 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-472 CWE-190

Affected software

Vendor	Product	Versions
Google	Chrome	>= 129.0.6668.89, < 129.0.6668.89
google	chrome	< 129.0.6668.89

References

https://chromereleases.googleblog.com/2024/10/stable-channel-update-for-desktop.htmlRelease Notes
https://issues.chromium.org/issues/367764861Exploit, Issue Tracking

Timeline

Published: Nov 27, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-70267.5Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Teknogis Informatics Closed Circuit Ve CVE-2024-70277.3The WooCommerce - PDF Vouchers plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 4.9.3. This is CVE-2024-70299.8Commands can be injected over the network and executed without authentication.CVE-2024-70304.3The Smart Online Order for Clover plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check CVE-2024-70318.8The File Manager Pro – Filester plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on CVE-2024-70326.5The Smart Online Order for Clover plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'CVE-2024-70356.9In version v0.3.8 of open-webui/open-webui, sensitive actions such as deleting and resetting are performed using the GET method. This vulner CVE-2024-70416.5An Insecure Direct Object Reference (IDOR) vulnerability exists in open-webui/open-webui version v0.3.8. The vulnerability occurs in the API CVE-2024-70429.8A vulnerability in the GraphCypherQAChain class of langchain-ai/langchainjs versions 0.2.5 and all versions with this class allows for promp CVE-2024-70438.8An improper access control vulnerability in open-webui/open-webui v0.3.8 allows attackers to view and delete any files. The application does CVE-2024-70448.9A Stored Cross-Site Scripting (XSS) vulnerability exists in the chat file upload functionality of open-webui/open-webui version 0.3.8. An at CVE-2024-70475.4A cross site scripting vulnerability exists in GitLab CE/EE affecting all versions from 16.6 prior to 17.0.5, 17.1 prior to 17.1.3, 17.2 pri