CVE-2024-5497: 
vulnerability analysis and mitigation

CVE-2024-5497 is a high-severity vulnerability affecting Google Chrome versions prior to 125.0.6422.141. The vulnerability involves an out-of-bounds memory access in the Browser UI component that could allow a remote attacker to exploit heap corruption through a crafted HTML page, provided they can convince a user to engage in specific UI gestures (Chrome Release).

The vulnerability is classified with a CVSS v3.1 base score of 8.8 (High) according to NVD, with a vector string of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. CISA-ADP has assigned a slightly lower score of 7.5 (High) with vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. The vulnerability is associated with CWE-787 (Out-of-bounds Write) and CWE-125 (Out-of-bounds Read) (NVD).

If successfully exploited, this vulnerability could lead to heap corruption, potentially allowing an attacker to execute arbitrary code within the context of the browser. The high CVSS scores indicate potential severe impacts on confidentiality, integrity, and availability of the affected system (NVD).

The vulnerability requires user interaction in the form of specific UI gestures and interaction with a crafted HTML page. The attack vector is network-accessible (remote), but successful exploitation requires user interaction (NVD).

The vulnerability has been patched in Google Chrome version 125.0.6422.141. Users are advised to update their Chrome browser to this version or later. The fix has also been incorporated into various Linux distributions, including Fedora 39 and 40 (Fedora Update).