8.8
HIGH
CVE-2024-12053
Description

Type Confusion in V8 in Google Chrome prior to 131.0.6778.108 allowed a remote attacker to potentially exploit object corruption via a crafted HTML page. (Chromium security severity: High)

INFO

Published Date :

Dec. 3, 2024, 7:15 p.m.

Last Modified :

Jan. 2, 2025, 5:47 p.m.

Source :

[email protected]

Remotely Exploitable :

Yes !

Impact Score :

5.9

Exploitability Score :

2.8
Affected Products

The following products are affected by CVE-2024-12053 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID Vendor Product Action
1 Google chrome
1 Microsoft edge_chromium
: Total Affected Vendor : 2 | Products : 2
References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2024-12053.

URL Resource
https://chromereleases.googleblog.com/2024/12/stable-channel-update-for-desktop.html Release Notes
https://issues.chromium.org/issues/379009132 Permissions Required

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2024-12053 vulnerability anywhere in the article.

  • Cybersecurity News
66,000 DrayTek Gateways Vulnerable to Remote Command Injection (CVE-2024-12987), PoC Published

Security researcher Netsecfish has discovered a command injection vulnerability, tracked as CVE-2024-12987, in the web management interface of popular DrayTek gateway devices. This flaw could enable a ... Read more

Published Date: Dec 31, 2024 (2 weeks, 5 days ago)
CVE-2024-12987 CVE-2024-49138 CVE-2024-53552 CVE-2024-12053 CVE-2024-53990 CVE-2024-48074 CVE-2024-41592
  • Cybersecurity News
CVE-2024-45387 (CVSS 9.9): Critical SQL Injection Vulnerability Found in Apache Traffic Control

A critical-severity security flaw has been uncovered in Apache Traffic Control, a popular open-source platform used to build large-scale content delivery networks (CDNs). This vulnerability, identifie ... Read more

Published Date: Dec 25, 2024 (3 weeks, 4 days ago)
CVE-2024-45387 CVE-2024-10205 CVE-2024-49138 CVE-2024-53552 CVE-2024-12053 CVE-2023-32428
  • Cybersecurity News
CVE-2024-30088 Under Attack: OilRig Targets Windows Kernel Vulnerability

Renowned for cyber espionage activities targeting critical sectors in the Middle East, OilRig, also known as APT34 or Helix Kitten operates with precision, exploiting vulnerabilities and employing adv ... Read more

Published Date: Dec 25, 2024 (3 weeks, 4 days ago)
CVE-2024-49138 CVE-2024-53552 CVE-2024-12053 CVE-2024-30088 CVE-2023-32428
  • Cybersecurity News
CVE-2024-51466 (CVSS 9.0): Critical Vulnerability Found in IBM Cognos Analytics

IBM has disclosed two severe vulnerabilities in its Cognos Analytics platform that could compromise sensitive data and system integrity. These vulnerabilities, identified as CVE-2024-51466 and CVE-202 ... Read more

Published Date: Dec 22, 2024 (4 weeks ago)
CVE-2024-51466 CVE-2024-40695 CVE-2024-49138 CVE-2024-12053 CVE-2024-10127 CVE-2024-10126 CVE-2023-32428
  • Cybersecurity News
Earth Koshchei’s Rogue RDP Campaign: A Sophisticated APT Attack Targets Governments and Enterprises

Trend Micro has unveiled a large-scale rogue remote desktop protocol (RDP) campaign conducted by the threat group Earth Koshchei. Known for their espionage operations, Earth Koshchei leveraged spear-p ... Read more

Published Date: Dec 20, 2024 (4 weeks, 2 days ago)
CVE-2024-49138 CVE-2024-12053 CVE-2024-21887 CVE-2023-32428
  • Cybersecurity News
Schneider Electric Warns of Critical Flaw in Modicon Controllers – CVE-2024-11737 (CVSS 9.8)

Schneider Electric has issued a security notification warning of a critical vulnerability affecting its Modicon M241, M251, M258, and LMC058 Programmable Logic Controllers (PLCs). The vulnerability, t ... Read more

Published Date: Dec 11, 2024 (1 month, 1 week ago)
CVE-2024-49138 CVE-2024-11737 CVE-2024-12053 CVE-2024-8884 CVE-2023-32428
  • tripwire.com
VERT Threat Alert: December 2024 Patch Tuesday Analysis

Today’s VERT Alert addresses Microsoft’s December 2024 Security Updates. VERT is actively working on coverage for these vulnerabilities and expects to ship ASPL-1136 as soon as coverage is completed.I ... Read more

Published Date: Dec 10, 2024 (1 month, 1 week ago)
CVE-2024-49142 CVE-2024-49138 CVE-2024-49132 CVE-2024-49129 CVE-2024-49128 CVE-2024-49127 CVE-2024-49126 CVE-2024-49125 CVE-2024-49124 CVE-2024-49123 ...+62 more CVE
  • BleepingComputer
Microsoft December 2024 Patch Tuesday fixes 1 exploited zero-day, 71 flaws

Today is Microsoft's December 2024 Patch Tuesday, which includes security updates for 71 flaws, including one actively exploited zero-day vulnerability.This Patch Tuesday fixed sixteen critical vulner ... Read more

Published Date: Dec 10, 2024 (1 month, 1 week ago)
CVE-2024-49142 CVE-2024-49138 CVE-2024-49132 CVE-2024-49129 CVE-2024-49128 CVE-2024-49127 CVE-2024-49126 CVE-2024-49125 CVE-2024-49124 CVE-2024-49123 ...+62 more CVE
  • Cybersecurity News
CVE-2024-47578 (CVSS 9.1): SAP Issues Critical Patch for NetWeaver AS for JAVA

SAP’s latest Security Patch Day, released today, detailed 10 new Security Notes alongside updates to three previously released notes. Among the newly disclosed vulnerabilities, multiple critical and h ... Read more

Published Date: Dec 10, 2024 (1 month, 1 week ago)
CVE-2024-49138 CVE-2024-54198 CVE-2024-54197 CVE-2024-47581 CVE-2024-47580 CVE-2024-47579 CVE-2024-47578 CVE-2024-47576 CVE-2024-12053 CVE-2024-47590 ...+1 more CVE
  • Cybersecurity News
CVE-2024-50623: Critical Vulnerability in Cleo Software Actively Exploited in the Wild

Huntress Labs has raised the alarm over the active exploitation of a critical vulnerability (CVE-2024-50623) in Cleo’s Harmony, VLTrader, and LexiCom software, commonly used for managing file transfer ... Read more

Published Date: Dec 10, 2024 (1 month, 1 week ago)
CVE-2024-49138 CVE-2024-12053 CVE-2024-50623 CVE-2023-47246 CVE-2023-32428
  • The Hacker News
⚡ THN Recap: Top Cybersecurity Threats, Tools and Tips (Dec 2 - 8)

Cyber Threats / Weekly Recap This week's cyber world is like a big spy movie. Hackers are breaking into other hackers' setups, sneaky malware is hiding in popular software, and AI-powered scams are tr ... Read more

Published Date: Dec 09, 2024 (1 month, 1 week ago)
CVE-2024-42448 CVE-2024-12209 CVE-2024-20397 CVE-2024-12053 CVE-2024-10905 CVE-2024-49806 CVE-2024-49805 CVE-2024-49804 CVE-2024-49803 CVE-2024-52338 ...+10 more CVE
  • Cybersecurity News
CVE-2024-53990 (CVSS 9.2): AsyncHttpClient Vulnerability Puts Java Applications at Risk

A critical severity vulnerability (CVE-2024-53990) has been discovered in the AsyncHttpClient (AHC) library, a popular Java library used for making asynchronous HTTP requests. This vulnerability, with ... Read more

Published Date: Dec 06, 2024 (1 month, 1 week ago)
CVE-2024-49138 CVE-2024-12053 CVE-2024-53990 CVE-2023-32428
  • TheCyberThrone
POC Exploit released for WhatsUp Gold CVE-2024-8785

Security researchers have published a proof-of-concept (PoC) exploit for CVE-2024-8785 with a CVSS score of 9.8, a critical remote code execution vulnerability affecting Progress WhatsUp Gold,A critic ... Read more

Published Date: Dec 05, 2024 (1 month, 2 weeks ago)
CVE-2024-54677 CVE-2024-50379 CVE-2024-49112 CVE-2024-53677 CVE-2024-12053 CVE-2024-8785 CVE-2024-51378
  • TheCyberThrone
Google Patches CVE-2024-12053 in Chrome

Google has released patches for a high severity vulnerability in its popular  Chrome web browser residing within the V8 JavaScript engine and allow attackers to execute arbitrary code on users’ system ... Read more

Published Date: Dec 04, 2024 (1 month, 2 weeks ago)
CVE-2024-54677 CVE-2024-50379 CVE-2024-49112 CVE-2024-42448 CVE-2024-53677 CVE-2024-12053 CVE-2024-8785
  • Cybersecurity News
CISA Flags Three Actively Exploited Vulnerabilities in Critical Systems

The Cybersecurity and Infrastructure Security Agency (CISA) has issued an alert regarding three critical security vulnerabilities actively exploited in the wild. These vulnerabilities, now included in ... Read more

Published Date: Dec 04, 2024 (1 month, 2 weeks ago)
CVE-2024-49138 CVE-2024-12053 CVE-2024-11667 CVE-2024-11680 CVE-2023-45727 CVE-2023-32428
  • Cybersecurity News
Google Chrome Addresses High-Severity Flaw in V8 JavaScript Engine (CVE-2024-12053)

Google has released a security update for its Chrome web browser to mitigate a high-severity “type confusion” vulnerability (CVE-2024-12053) residing within the V8 JavaScript engine. This vulnerabilit ... Read more

Published Date: Dec 04, 2024 (1 month, 2 weeks ago)
CVE-2024-12053 CVE-2024-10905 CVE-2024-42327 CVE-2024-52067 CVE-2020-12271
  • Cybersecurity News
Protect Your Network: Zyxel Issues Firmware Updates

Zyxel Networks has released firmware updates to address multiple vulnerabilities affecting a range of its networking products, including 4G LTE/5G NR CPEs, DSL/Ethernet CPEs, fiber ONTs, and WiFi exte ... Read more

Published Date: Dec 04, 2024 (1 month, 2 weeks ago)
CVE-2024-49138 CVE-2024-12053 CVE-2024-9200 CVE-2024-9197 CVE-2024-8748 CVE-2024-6342 CVE-2024-7261 CVE-2023-32428 CVE-2023-33010 CVE-2023-33009

The following table lists the changes that have been made to the CVE-2024-12053 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • Initial Analysis by [email protected]

    Jan. 02, 2025

    Action Type Old Value New Value
    Added CVSS V3.1 NIST AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
    Added CWE NIST CWE-843
    Added CPE Configuration OR *cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* versions up to (excluding) 131.0.6778.108
    Changed Reference Type https://chromereleases.googleblog.com/2024/12/stable-channel-update-for-desktop.html No Types Assigned https://chromereleases.googleblog.com/2024/12/stable-channel-update-for-desktop.html Release Notes
    Changed Reference Type https://issues.chromium.org/issues/379009132 No Types Assigned https://issues.chromium.org/issues/379009132 Permissions Required
  • CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0

    Dec. 03, 2024

    Action Type Old Value New Value
    Added CVSS V3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
    Added CWE CWE-843
  • New CVE Received by [email protected]

    Dec. 03, 2024

    Action Type Old Value New Value
    Added Description Type Confusion in V8 in Google Chrome prior to 131.0.6778.108 allowed a remote attacker to potentially exploit object corruption via a crafted HTML page. (Chromium security severity: High)
    Added CWE CWE-843
    Added Reference https://chromereleases.googleblog.com/2024/12/stable-channel-update-for-desktop.html
    Added Reference https://issues.chromium.org/issues/379009132
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.
CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2024-12053 is associated with the following CWEs:

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2024-12053 weaknesses.

CVSS31 - Vulnerability Scoring System
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
: