CVE-2024-9961

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Use after free in ParcelTracking in Google Chrome on iOS prior to 130.0.6723.58 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

Vendor	Product	Versions
Google	Chrome	>= 130.0.6723.58, < 130.0.6723.58
google	chrome	< 130.0.6723.58

References

https://chromereleases.googleblog.com/2024/10/stable-channel-update-for-desktop_15.htmlRelease Notes
https://issues.chromium.org/issues/357776197Exploit, Issue Tracking

Timeline

Published: Oct 15, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-99624.3Inappropriate implementation in Permissions in Google Chrome prior to 130.0.6723.58 allowed a remote attacker who convinced a user to engage CVE-2024-99634.3Insufficient data validation in Downloads in Google Chrome prior to 130.0.6723.58 allowed a remote attacker who convinced a user to engage i CVE-2024-99644.3Inappropriate implementation in Payments in Google Chrome prior to 130.0.6723.58 allowed a remote attacker who convinced a user to engage in CVE-2024-99658.8Insufficient data validation in DevTools in Google Chrome on Windows prior to 130.0.6723.58 allowed a remote attacker who convinced a user t CVE-2024-99665.3Inappropriate implementation in Navigations in Google Chrome prior to 130.0.6723.58 allowed a remote attacker to bypass content security pol CVE-2024-99675.4The WP show more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's show_more shortcode in all versions up t CVE-2024-99688.8WebEIP v3.0 from NewType does not properly validate user input, allowing remote attackers with regular privilege to inject SQL commands to CVE-2024-99695.4NewType WebEIP v3.0 does not properly validate user input, allowing a remote attacker with regular privileges to insert JavaScript into spec CVE-2024-99708.8The FlowMaster BPM Plus system from NewType has a privilege escalation vulnerability. Remote attackers with regular privileges can elevate t CVE-2024-99718.8The specific query functionality in the FlowMaster BPM Plus from NewType does not properly restrict user input, allowing remote attackers wi CVE-2024-99729.8Property Management System from ChanGate has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQ CVE-2024-99739.8A vulnerability was found in SourceCodester Online Eyewear Shop 1.0. It has been classified as critical. Affected is an unknown function of