CVE-2024-21336: Microsoft Edge (Chromium-based) Spoofing Vulnerability

Overview

Severity
Low (CVSS 2.5)
CVSS Vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C
Category
Edge - Chromium
Exploit Status
Not Exploited
Exploitation Likelihood
Less Likely
Patch Tuesday
2024-Jan
Released
2024-01-26
EPSS Score
0.33% (percentile: 56.3%)

FAQ

According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do? Exploitation of the vulnerability requires the victim to open the vulnerable app. According to the CVSS metric, successful exploitation of this vulnerability could lead to some loss of integrity (I:L)? What does that mean for this vulnerability? An attacker who successfully exploited this vulnerability could cover and spoof elements of the UI. The modified information is only visual. What is the version information for this release? Microsoft Edge Channel Microsoft Edge Version Date Released Based on Chromium Version Stable 121.0.2277.83 1/25/2024 121.0.6167.85/.86 Extended Stable 120.0.2210.160 1/25/2024 120.0.6099.268 According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability? Successful exploitation of this vulnerability requires an attacker to take additional actions prior to exploitation to prepare the target environment.

Affected Products (1)

Browser

  • Microsoft Edge (Chromium-based)

Acknowledgments

<a href="https://www.linkedin.com/in/hafiizh-7aa6bb31/">Hafiizh</a> with https://www.linkedin.com/in/hafiizh-7aa6bb31/

Revision History

  • 2024-01-26: Information published.