What’s Vulnerable › Vulnerabilities
CVE-2024-3157
- Severity: critical (CVSS 9.6 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.8% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2024-04-10 · updated 2026-06-17
- Weakness: CWE-787
Description
Out of bounds memory access in Compositing in Google Chrome prior to 123.0.6312.122 allowed a remote attacker who had compromised the GPU process to potentially perform a sandbox escape via specific UI gestures. (Chromium security severity: High)
Affected products
- Fedoraproject Fedora: 38, 39, 40
- Google Chrome: before 123.0.6312.122 — fixed in 123.0.6312.122
How to fix
Upgrade to a fixed version: Google Chrome 123.0.6312.122. Check the vendor advisory for mitigations.
References
- https://chromereleases.googleblog.com/2024/04/stable-channel-update-for-desktop_10.html
- https://issues.chromium.org/issues/331237485
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5EW66LXDACTB5FCHLUPZOGD2KA2J62Q2/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EVEJEW7UCSUSK2J2FYQRZZPI74P2D3JP/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NDHNEFD76ORM7WBWAEZT6HSYDMZVIED4/
- https://chromereleases.googleblog.com/2024/04/stable-channel-update-for-desktop_10.html
- https://issues.chromium.org/issues/331237485
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5EW66LXDACTB5FCHLUPZOGD2KA2J62Q2/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EVEJEW7UCSUSK2J2FYQRZZPI74P2D3JP/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NDHNEFD76ORM7WBWAEZT6HSYDMZVIED4/
Get alerted when CVE-2024-3157 or the next vulnerability affects your stack