CVE-2024-8909 - Vulnerability Details

Vendors	Products
Apple	Iphone Os
Google	Chrome

Link	Providers
https://chromereleases.googleblog.com/2024/09/stable-channel-update-for-desktop_17.html
https://issues.chromium.org/issues/341353783

Type	Values Removed	Values Added
Weaknesses		CWE-451

Type	Values Removed	Values Added
First Time appeared		Apple Apple iphone Os Google Google chrome
Weaknesses		NVD-CWE-noinfo
CPEs		cpe:2.3:a:google:chrome:::::::: cpe:2.3:o:apple:iphone_os:-:::::::*
Vendors & Products		Apple Apple iphone Os Google Google chrome
Metrics		cvssV3_1 `{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N'}`

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Type	Values Removed	Values Added
Description		Inappropriate implementation in UI in Google Chrome on iOS prior to 129.0.6668.58 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)
References		https://chromereleases.googleblog.com/2024/09/stable-channel-update-for-desktop_17.html https://issues.chromium.org/issues/341353783

Show plain JSON

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-8909", "assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28", "state": "PUBLISHED", "assignerShortName": "Chrome", "dateReserved": "2024-09-16T20:06:02.088Z", "datePublished": "2024-09-17T21:07:19.868Z", "dateUpdated": "2025-03-17T15:52:57.328Z"}, "containers": {"cna": {"affected": [{"vendor": "Google", "product": "Chrome", "versions": [{"version": "129.0.6668.58", "status": "affected", "lessThan": "129.0.6668.58", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "Inappropriate implementation in UI in Google Chrome on iOS prior to 129.0.6668.58 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Inappropriate implementation"}]}], "providerMetadata": {"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28", "shortName": "Chrome", "dateUpdated": "2024-09-17T21:07:19.868Z"}, "references": [{"url": "https://chromereleases.googleblog.com/2024/09/stable-channel-update-for-desktop_17.html"}, {"url": "https://issues.chromium.org/issues/341353783"}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-451", "lang": "en", "description": "CWE-451 User Interface (UI) Misrepresentation of Critical Information"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-09-18T14:46:00.552262Z", "id": "CVE-2024-8909", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-17T15:52:57.328Z"}}]}}

{

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

cveMetadata : { »

cveId : CVE-2024-8909 (string)

assignerOrgId : ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28 (string)

state : PUBLISHED (string)

assignerShortName : Chrome (string)

dateReserved : 2024-09-16T20:06:02.088Z (string)

datePublished : 2024-09-17T21:07:19.868Z (string)

dateUpdated : 2025-03-17T15:52:57.328Z (string)

}

containers : { »

cna : { »

affected : [ »

0 : { »

vendor : Google (string)

product : Chrome (string)

versions : [ »

0 : { »

version : 129.0.6668.58 (string)

status : affected (string)

lessThan : 129.0.6668.58 (string)

versionType : custom (string)

}

]

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : Inappropriate implementation in UI in Google Chrome on iOS prior to 129.0.6668.58 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low) (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

description : Inappropriate implementation (string)

}

]

}

]

providerMetadata : { »

orgId : ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28 (string)

shortName : Chrome (string)

dateUpdated : 2024-09-17T21:07:19.868Z (string)

}

references : [ »

0 : { »

url : https://chromereleases.googleblog.com/2024/09/stable-channel-update-for-desktop_17.html (string)

}

1 : { »

url : https://issues.chromium.org/issues/341353783 (string)

}

]

}

adp : [ »

0 : { »

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

type : CWE (string)

cweId : CWE-451 (string)

lang : en (string)

description : CWE-451 User Interface (UI) Misrepresentation of Critical Information (string)

}

]

}

]

metrics : [ »

0 : { »

cvssV3_1 : { »

scope : UNCHANGED (string)

version : 3.1 (string)

baseScore : 4.3 (number)

attackVector : NETWORK (string)

baseSeverity : MEDIUM (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N (string)

integrityImpact : LOW (string)

userInteraction : REQUIRED (string)

attackComplexity : LOW (string)

availabilityImpact : NONE (string)

privilegesRequired : NONE (string)

confidentialityImpact : NONE (string)

}

1 : { »

other : { »

type : ssvc (string)

content : { »

timestamp : 2024-09-18T14:46:00.552262Z (string)

id : CVE-2024-8909 (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : partial (string)

}

]

role : CISA Coordinator (string)

version : 2.0.3 (string)

}

]

title : CISA ADP Vulnrichment (string)

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2025-03-17T15:52:57.328Z (string)

}

]

}

Show plain JSON

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-8909", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-18T14:46:00.552262Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-451", "description": "CWE-451 User Interface (UI) Misrepresentation of Critical Information"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-18T14:46:08.243Z"}}], "cna": {"affected": [{"vendor": "Google", "product": "Chrome", "versions": [{"status": "affected", "version": "129.0.6668.58", "lessThan": "129.0.6668.58", "versionType": "custom"}]}], "references": [{"url": "https://chromereleases.googleblog.com/2024/09/stable-channel-update-for-desktop_17.html"}, {"url": "https://issues.chromium.org/issues/341353783"}], "descriptions": [{"lang": "en", "value": "Inappropriate implementation in UI in Google Chrome on iOS prior to 129.0.6668.58 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Inappropriate implementation"}]}], "providerMetadata": {"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28", "shortName": "Chrome", "dateUpdated": "2024-09-17T21:07:19.868Z"}}}, "cveMetadata": {"cveId": "CVE-2024-8909", "state": "PUBLISHED", "dateUpdated": "2025-03-17T15:52:57.328Z", "dateReserved": "2024-09-16T20:06:02.088Z", "assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28", "datePublished": "2024-09-17T21:07:19.868Z", "assignerShortName": "Chrome"}, "dataVersion": "5.1"}

{

dataType : CVE_RECORD (string)

containers : { »

adp : [ »

0 : { »

title : CISA ADP Vulnrichment (string)

metrics : [ »

0 : { »

cvssV3_1 : { »

scope : UNCHANGED (string)

version : 3.1 (string)

baseScore : 4.3 (number)

attackVector : NETWORK (string)

baseSeverity : MEDIUM (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N (string)

integrityImpact : LOW (string)

userInteraction : REQUIRED (string)

attackComplexity : LOW (string)

availabilityImpact : NONE (string)

privilegesRequired : NONE (string)

confidentialityImpact : NONE (string)

}

1 : { »

other : { »

type : ssvc (string)

content : { »

id : CVE-2024-8909 (string)

role : CISA Coordinator (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : partial (string)

}

]

version : 2.0.3 (string)

timestamp : 2024-09-18T14:46:00.552262Z (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

type : CWE (string)

cweId : CWE-451 (string)

description : CWE-451 User Interface (UI) Misrepresentation of Critical Information (string)

}

]

}

]

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-09-18T14:46:08.243Z (string)

}

]

cna : { »

affected : [ »

0 : { »

vendor : Google (string)

product : Chrome (string)

versions : [ »

0 : { »

status : affected (string)

version : 129.0.6668.58 (string)

lessThan : 129.0.6668.58 (string)

versionType : custom (string)

}

]

}

]

references : [ »

0 : { »

url : https://chromereleases.googleblog.com/2024/09/stable-channel-update-for-desktop_17.html (string)

}

1 : { »

url : https://issues.chromium.org/issues/341353783 (string)

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : Inappropriate implementation in UI in Google Chrome on iOS prior to 129.0.6668.58 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low) (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

description : Inappropriate implementation (string)

}

]

}

]

providerMetadata : { »

orgId : ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28 (string)

shortName : Chrome (string)

dateUpdated : 2024-09-17T21:07:19.868Z (string)

}

cveMetadata : { »

cveId : CVE-2024-8909 (string)

state : PUBLISHED (string)

dateUpdated : 2025-03-17T15:52:57.328Z (string)

dateReserved : 2024-09-16T20:06:02.088Z (string)

assignerOrgId : ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28 (string)

datePublished : 2024-09-17T21:07:19.868Z (string)

assignerShortName : Chrome (string)

}

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*", "matchCriteriaId": "1C2C3CE1-E8FB-4A05-B400-973CE069B66C", "versionEndExcluding": "129.0.6668.58", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:apple:iphone_os:-:*:*:*:*:*:*:*", "matchCriteriaId": "B5415705-33E5-46D5-8E4D-9EBADC8C5705", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Inappropriate implementation in UI in Google Chrome on iOS prior to 129.0.6668.58 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)"}, {"lang": "es", "value": "Una implementaci\u00f3n inadecuada en la interfaz de usuario de Google Chrome en iOS anterior a la versi\u00f3n 129.0.6668.58 permiti\u00f3 que un atacante remoto suplantara la interfaz de usuario a trav\u00e9s de una p\u00e1gina HTML manipulada espec\u00edficamente. (Gravedad de seguridad de Chromium: baja)"}], "id": "CVE-2024-8909", "lastModified": "2025-03-17T16:15:23.870", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2024-09-17T21:15:13.313", "references": [{"source": "chrome-cve-admin@google.com", "tags": ["Release Notes"], "url": "https://chromereleases.googleblog.com/2024/09/stable-channel-update-for-desktop_17.html"}, {"source": "chrome-cve-admin@google.com", "tags": ["Permissions Required"], "url": "https://issues.chromium.org/issues/341353783"}], "sourceIdentifier": "chrome-cve-admin@google.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-451"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 1C2C3CE1-E8FB-4A05-B400-973CE069B66C (string)

versionEndExcluding : 129.0.6668.58 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

1 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:o:apple:iphone_os:-:*:*:*:*:*:*:* (string)

matchCriteriaId : B5415705-33E5-46D5-8E4D-9EBADC8C5705 (string)

vulnerable : false (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

operator : AND (string)

}

]

cveTags : [ *empty* ]

descriptions : [ »

0 : { »

lang : en (string)

value : Inappropriate implementation in UI in Google Chrome on iOS prior to 129.0.6668.58 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low) (string)

}

1 : { »

lang : es (string)

value : Una implementación inadecuada en la interfaz de usuario de Google Chrome en iOS anterior a la versión 129.0.6668.58 permitió que un atacante remoto suplantara la interfaz de usuario a través de una página HTML manipulada específicamente. (Gravedad de seguridad de Chromium: baja) (string)

}

]

id : CVE-2024-8909 (string)

lastModified : 2025-03-17T16:15:23.870 (string)

metrics : { »

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 4.3 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : NONE (string)

integrityImpact : LOW (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : REQUIRED (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N (string)

version : 3.1 (string)

}

exploitabilityScore : 2.8 (number)

impactScore : 1.4 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

1 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 4.3 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : NONE (string)

integrityImpact : LOW (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : REQUIRED (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N (string)

version : 3.1 (string)

}

exploitabilityScore : 2.8 (number)

impactScore : 1.4 (number)

source : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

type : Secondary (string)

}

]

}

published : 2024-09-17T21:15:13.313 (string)

references : [ »

0 : { »

source : chrome-cve-admin@google.com (string)

tags : [ »

0 : Release Notes (string)

]

url : https://chromereleases.googleblog.com/2024/09/stable-channel-update-for-desktop_17.html (string)

}

1 : { »

source : chrome-cve-admin@google.com (string)

tags : [ »

0 : Permissions Required (string)

]

url : https://issues.chromium.org/issues/341353783 (string)

}

]

sourceIdentifier : chrome-cve-admin@google.com (string)

vulnStatus : Modified (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : NVD-CWE-noinfo (string)

}

]

source : nvd@nist.gov (string)

type : Primary (string)

}

1 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-451 (string)

}

]

source : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

type : Secondary (string)

}

]

}

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction Required

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction Required

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object