CVE-2024-38221: Microsoft Edge (Chromium-based) Spoofing Vulnerability

Overview

Severity

Medium (CVSS 4.3)

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C

Category

Edge - Chromium

Exploit Status

Not Exploited

Exploitation Likelihood

Less Likely

Patch Tuesday

2024-Sep

Released

2024-09-19

EPSS Score

0.41% (percentile: 61.1%)

FAQ

According to the CVSS metric, user interaction is required (UI:R). What does that mean for this vulnerability? Successful exploitation requires the victim to perform multiple steps to trigger the vulnerability. According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do? The user would have to click on a specially crafted URL to be compromised by the attacker. According to the CVSS metric, successful exploitation of this vulnerability could lead to some loss of integrity (I:L)? What does that mean for this vulnerability? The attacker is only able to modify the content of the vulnerable link to redirect the victim to a malicious site. What is the version information for this release? Microsoft Edge Channel Microsoft Edge Version Based on Chromium Version Date Released Stable CVE-2024-8904, 129.0.6668.58/.59 9/19/2024

Affected Products (1)

Browser

• Microsoft Edge (Chromium-based)

Acknowledgments

Anonymous

Revision History

• 2024-09-19: Information published.