CVE-2024-3846: 
vulnerability analysis and mitigation

CVE-2024-3846 is a low severity vulnerability affecting Google Chrome versions prior to 124.0.6367.60. The vulnerability stems from an inappropriate implementation in Prompts functionality that could allow a remote attacker to perform UI spoofing via a crafted HTML page, but only if they can convince a user to engage in specific UI gestures (Chrome Release).

The vulnerability has been assigned a CVSS v3.1 base score of 4.3 (MEDIUM) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. CISA-ADP has rated it slightly higher with a CVSS score of 5.4 (MEDIUM) and vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N. The vulnerability requires user interaction and can only be exploited through a specially crafted HTML page (NVD).

The vulnerability allows an attacker to perform UI spoofing attacks, potentially misleading users through manipulated interface elements. The impact is considered low as it requires user interaction and only affects the interface presentation (Chrome Release).

The vulnerability requires an attacker to craft a specific HTML page and convince a user to engage in particular UI gestures. While the attack complexity is considered low, the requirement for user interaction makes exploitation more challenging (NVD).

The vulnerability has been patched in Google Chrome version 124.0.6367.60. Users are advised to update to this version or later to mitigate the risk. The fix has been distributed to various platforms including Windows, Mac, and Linux (Chrome Release).