CVE-2024-7001 - Vulnerability Details

Vendors	Products
Google	Chrome

Link	Providers
https://chromereleases.googleblog.com/2024/07/stable-channel-update-for-desktop_23.html
https://issues.chromium.org/issues/347509736
https://nvd.nist.gov/vuln/detail/CVE-2024-7001
https://www.cve.org/CVERecord?id=CVE-2024-7001

Type	Values Removed	Values Added
Weaknesses		CWE-474

Type	Values Removed	Values Added
First Time appeared		Google Google chrome
Weaknesses		NVD-CWE-noinfo
CPEs		cpe:2.3:a:google:chrome::::::::
Vendors & Products		Google Google chrome
Metrics	cvssV3_1 `{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}`	cvssV3_1 `{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N'}`

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Type	Values Removed	Values Added
Title		chromium-browser: Inappropriate implementation in HTML
Weaknesses		CWE-284
References		https://nvd.nist.gov/vuln/detail/CVE-2024-7001 https://www.cve.org/CVERecord?id=CVE-2024-7001
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}` threat_severity `Moderate`

Show plain JSON

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-7001", "assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28", "state": "PUBLISHED", "assignerShortName": "Chrome", "dateReserved": "2024-07-22T23:32:40.413Z", "datePublished": "2024-08-06T15:37:26.654Z", "dateUpdated": "2025-03-19T15:20:12.427Z"}, "containers": {"cna": {"affected": [{"vendor": "Google", "product": "Chrome", "versions": [{"version": "127.0.6533.72", "status": "affected", "lessThan": "127.0.6533.72", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "Inappropriate implementation in HTML in Google Chrome prior to 127.0.6533.72 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Inappropriate implementation"}]}], "providerMetadata": {"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28", "shortName": "Chrome", "dateUpdated": "2024-08-06T15:37:26.654Z"}, "references": [{"url": "https://chromereleases.googleblog.com/2024/07/stable-channel-update-for-desktop_23.html"}, {"url": "https://issues.chromium.org/issues/347509736"}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-474", "lang": "en", "description": "CWE-474 Use of Function with Inconsistent Implementations"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-08-07T15:29:06.617946Z", "id": "CVE-2024-7001", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-19T15:20:12.427Z"}}]}}

{

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

cveMetadata : { »

cveId : CVE-2024-7001 (string)

assignerOrgId : ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28 (string)

state : PUBLISHED (string)

assignerShortName : Chrome (string)

dateReserved : 2024-07-22T23:32:40.413Z (string)

datePublished : 2024-08-06T15:37:26.654Z (string)

dateUpdated : 2025-03-19T15:20:12.427Z (string)

}

containers : { »

cna : { »

affected : [ »

0 : { »

vendor : Google (string)

product : Chrome (string)

versions : [ »

0 : { »

version : 127.0.6533.72 (string)

status : affected (string)

lessThan : 127.0.6533.72 (string)

versionType : custom (string)

}

]

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : Inappropriate implementation in HTML in Google Chrome prior to 127.0.6533.72 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium) (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

description : Inappropriate implementation (string)

}

]

}

]

providerMetadata : { »

orgId : ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28 (string)

shortName : Chrome (string)

dateUpdated : 2024-08-06T15:37:26.654Z (string)

}

references : [ »

0 : { »

url : https://chromereleases.googleblog.com/2024/07/stable-channel-update-for-desktop_23.html (string)

}

1 : { »

url : https://issues.chromium.org/issues/347509736 (string)

}

]

}

adp : [ »

0 : { »

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

type : CWE (string)

cweId : CWE-474 (string)

lang : en (string)

description : CWE-474 Use of Function with Inconsistent Implementations (string)

}

]

}

]

metrics : [ »

0 : { »

cvssV3_1 : { »

scope : UNCHANGED (string)

version : 3.1 (string)

baseScore : 4.3 (number)

attackVector : NETWORK (string)

baseSeverity : MEDIUM (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N (string)

integrityImpact : LOW (string)

userInteraction : REQUIRED (string)

attackComplexity : LOW (string)

availabilityImpact : NONE (string)

privilegesRequired : NONE (string)

confidentialityImpact : NONE (string)

}

1 : { »

other : { »

type : ssvc (string)

content : { »

timestamp : 2024-08-07T15:29:06.617946Z (string)

id : CVE-2024-7001 (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : partial (string)

}

]

role : CISA Coordinator (string)

version : 2.0.3 (string)

}

]

title : CISA ADP Vulnrichment (string)

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2025-03-19T15:20:12.427Z (string)

}

]

}

Show plain JSON

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-7001", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-08-07T15:29:06.617946Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-474", "description": "CWE-474 Use of Function with Inconsistent Implementations"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-07T15:29:17.455Z"}}], "cna": {"affected": [{"vendor": "Google", "product": "Chrome", "versions": [{"status": "affected", "version": "127.0.6533.72", "lessThan": "127.0.6533.72", "versionType": "custom"}]}], "references": [{"url": "https://chromereleases.googleblog.com/2024/07/stable-channel-update-for-desktop_23.html"}, {"url": "https://issues.chromium.org/issues/347509736"}], "descriptions": [{"lang": "en", "value": "Inappropriate implementation in HTML in Google Chrome prior to 127.0.6533.72 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Inappropriate implementation"}]}], "providerMetadata": {"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28", "shortName": "Chrome", "dateUpdated": "2024-08-06T15:37:26.654Z"}}}, "cveMetadata": {"cveId": "CVE-2024-7001", "state": "PUBLISHED", "dateUpdated": "2025-03-19T15:20:12.427Z", "dateReserved": "2024-07-22T23:32:40.413Z", "assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28", "datePublished": "2024-08-06T15:37:26.654Z", "assignerShortName": "Chrome"}, "dataVersion": "5.1"}

{

dataType : CVE_RECORD (string)

containers : { »

adp : [ »

0 : { »

title : CISA ADP Vulnrichment (string)

metrics : [ »

0 : { »

cvssV3_1 : { »

scope : UNCHANGED (string)

version : 3.1 (string)

baseScore : 4.3 (number)

attackVector : NETWORK (string)

baseSeverity : MEDIUM (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N (string)

integrityImpact : LOW (string)

userInteraction : REQUIRED (string)

attackComplexity : LOW (string)

availabilityImpact : NONE (string)

privilegesRequired : NONE (string)

confidentialityImpact : NONE (string)

}

1 : { »

other : { »

type : ssvc (string)

content : { »

id : CVE-2024-7001 (string)

role : CISA Coordinator (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : partial (string)

}

]

version : 2.0.3 (string)

timestamp : 2024-08-07T15:29:06.617946Z (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

type : CWE (string)

cweId : CWE-474 (string)

description : CWE-474 Use of Function with Inconsistent Implementations (string)

}

]

}

]

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-08-07T15:29:17.455Z (string)

}

]

cna : { »

affected : [ »

0 : { »

vendor : Google (string)

product : Chrome (string)

versions : [ »

0 : { »

status : affected (string)

version : 127.0.6533.72 (string)

lessThan : 127.0.6533.72 (string)

versionType : custom (string)

}

]

}

]

references : [ »

0 : { »

url : https://chromereleases.googleblog.com/2024/07/stable-channel-update-for-desktop_23.html (string)

}

1 : { »

url : https://issues.chromium.org/issues/347509736 (string)

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : Inappropriate implementation in HTML in Google Chrome prior to 127.0.6533.72 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium) (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

description : Inappropriate implementation (string)

}

]

}

]

providerMetadata : { »

orgId : ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28 (string)

shortName : Chrome (string)

dateUpdated : 2024-08-06T15:37:26.654Z (string)

}

cveMetadata : { »

cveId : CVE-2024-7001 (string)

state : PUBLISHED (string)

dateUpdated : 2025-03-19T15:20:12.427Z (string)

dateReserved : 2024-07-22T23:32:40.413Z (string)

assignerOrgId : ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28 (string)

datePublished : 2024-08-06T15:37:26.654Z (string)

assignerShortName : Chrome (string)

}

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*", "matchCriteriaId": "65366FE2-8A36-426D-8960-39E8A6DF6DEA", "versionEndExcluding": "127.0.6533.72", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Inappropriate implementation in HTML in Google Chrome prior to 127.0.6533.72 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)"}, {"lang": "es", "value": "La implementaci\u00f3n inapropiada de HTML en Google Chrome anterior a 127.0.6533.72 permiti\u00f3 que un atacante remoto convenciera a un usuario de realizar gestos espec\u00edficos de la interfaz de usuario para realizar una suplantaci\u00f3n de la interfaz de usuario a trav\u00e9s de una p\u00e1gina HTML manipulada. (Severidad de seguridad de Chromium: media)"}], "id": "CVE-2024-7001", "lastModified": "2025-03-19T16:15:29.243", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2024-08-06T16:15:50.643", "references": [{"source": "chrome-cve-admin@google.com", "tags": ["Release Notes"], "url": "https://chromereleases.googleblog.com/2024/07/stable-channel-update-for-desktop_23.html"}, {"source": "chrome-cve-admin@google.com", "tags": ["Issue Tracking"], "url": "https://issues.chromium.org/issues/347509736"}], "sourceIdentifier": "chrome-cve-admin@google.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-474"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 65366FE2-8A36-426D-8960-39E8A6DF6DEA (string)

versionEndExcluding : 127.0.6533.72 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

]

cveTags : [ *empty* ]

descriptions : [ »

0 : { »

lang : en (string)

value : Inappropriate implementation in HTML in Google Chrome prior to 127.0.6533.72 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium) (string)

}

1 : { »

lang : es (string)

value : La implementación inapropiada de HTML en Google Chrome anterior a 127.0.6533.72 permitió que un atacante remoto convenciera a un usuario de realizar gestos específicos de la interfaz de usuario para realizar una suplantación de la interfaz de usuario a través de una página HTML manipulada. (Severidad de seguridad de Chromium: media) (string)

}

]

id : CVE-2024-7001 (string)

lastModified : 2025-03-19T16:15:29.243 (string)

metrics : { »

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 4.3 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : NONE (string)

integrityImpact : LOW (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : REQUIRED (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N (string)

version : 3.1 (string)

}

exploitabilityScore : 2.8 (number)

impactScore : 1.4 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

1 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 4.3 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : NONE (string)

integrityImpact : LOW (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : REQUIRED (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N (string)

version : 3.1 (string)

}

exploitabilityScore : 2.8 (number)

impactScore : 1.4 (number)

source : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

type : Secondary (string)

}

]

}

published : 2024-08-06T16:15:50.643 (string)

references : [ »

0 : { »

source : chrome-cve-admin@google.com (string)

tags : [ »

0 : Release Notes (string)

]

url : https://chromereleases.googleblog.com/2024/07/stable-channel-update-for-desktop_23.html (string)

}

1 : { »

source : chrome-cve-admin@google.com (string)

tags : [ »

0 : Issue Tracking (string)

]

url : https://issues.chromium.org/issues/347509736 (string)

}

]

sourceIdentifier : chrome-cve-admin@google.com (string)

vulnStatus : Modified (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : NVD-CWE-noinfo (string)

}

]

source : nvd@nist.gov (string)

type : Primary (string)

}

1 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-474 (string)

}

]

source : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

type : Secondary (string)

}

]

}

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction Required

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction Required

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object