CVE-2024-9126

HighCVSS 7.5/10Last modified Oct 2, 2026

Description

Use after free in Internals in Google Chrome on iOS prior to 127.0.6533.88 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a series of curated UI gestures. (Chromium security severity: Medium)

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

No affected versions have been published.

Timeline

Published
Nov 14, 2025
Last modified
Oct 2, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-91275.4The Super Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘alignment’ parameter in all versions up toCVE-2024-91299.3In versions of Zend Server 8.5 and prior to version 9.2 a format string injection was discovered. Reported by Dylan MarinoCVE-2024-91307.2The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order’ parametCVE-2024-91317.2A user with administrator privileges can perform command injectionCVE-2024-91329.8The administrator is able to configure an insecure captive portal scriptCVE-2024-91335.6A user with administrator privileges is able to retrieve authentication tokensCVE-2024-91348.3Multiple SQL Injection vulnerabilities exist in the reporting application. A user with advanced report application access rights can exploiCVE-2024-91355.3On affected platforms running Arista EOS with BGP Link State configured, BGP peer flap can cause the BGP agent to leak memory. This may resuCVE-2024-91367.5Access permission verification vulnerability in the App Multiplier module Impact: Successful exploitation of this vulnerability may affect sCVE-2024-91379.4The affected product lacks an authentication check when sending commands to the server via the Moxa service. This vulnerability allows an atCVE-2024-91387.2Moxa’s cellular routers, secure routers, and network security appliances are affected by a high-severity vulnerability, CVE-2024-9138. This CVE-2024-91397.2The affected product permits OS command injection through improperly restricted commands, potentially allowing attackers to execute arbitrar
CVE-2024-9126: High severity, CVSS 7.5 | Vulnix