CVE-2024-9123

Integer overflow in Skia in Google Chrome prior to 129.0.6668.70 allowed a remote attacker to...

8.8 HighFix available

Integer overflow in Skia in Google Chrome prior to 129.0.6668.70 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: High)

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.48%Up 0.4 points since Sep 25, 2024

What each source reports

NVD Score used 8.8

Integer overflow in Skia in Google Chrome prior to 129.0.6668.70 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: High)

Record: CVE-2024-9123
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-472, CWE-190
Updated: 2026-11-02

CVE List 8.8

Integer overflow in Skia in Google Chrome prior to 129.0.6668.70 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: High)

Record: CVE-2024-9123
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-472, CWE-190
Updated: 2026-11-02

EUVDEUVD-2024-49745 8.8

Integer overflow in Skia in Google Chrome prior to 129.0.6668.70 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: High)

Record: EUVD-2024-49745
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-xwv3-34j2-7jgx 7.1

Integer overflow in Skia in Google Chrome prior to 129.0.6668.70 allowed a remote attacker to...

Integer overflow in Skia in Google Chrome prior to 129.0.6668.70 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: High)

Record: GHSA-xwv3-34j2-7jgx
CVSS 3.1: 7.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Weakness: CWE-190, CWE-472
Updated: 2026-11-02

OSVALPINE-CVE-2024-9123 8.8

Integer overflow in Skia in Google Chrome prior to 129.0.6668.70 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: High)

Record: ALPINE-CVE-2024-9123
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-03

OSV 8.8

Integer overflow in Skia in Google Chrome prior to 129.0.6668.70 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: High)

Record: CVE-2024-9123
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Show 16 moreShow less

OSVDEBIAN-CVE-2024-9123 8.8

Integer overflow in Skia in Google Chrome prior to 129.0.6668.70 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: High)

Record: DEBIAN-CVE-2024-9123
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2026:74084 9.6

Red Hat Security Advisory: webkit2gtk3 security update

Record: RHSA-2026:74084
CVSS 3.1: 9.6 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Updated: 2026-11-02

OSVRLSA-2026:69098 9.6

Important: webkit2gtk3 security update

WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.

Security Fix(es):

chromium-browser: Skia in Google Chrome: Sandbox escape via crafted HTML page (CVE-2026-19154)
chromium-browser: skia: Skia: Sandbox escape via out-of-bounds write in Chromium (CVE-2026-19173)
chromium-browser: Skia in Google Chrome: Cross-origin data leakage via uninitialized use (CVE-2026-19161)
chromium-browser: Skia: Arbitrary code execution via crafted HTML page (CVE-2026-19176)
chromium-browser: Chromium: Information leak allows web origin policy bypass (CVE-2026-76041)
webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-28984)
webkitgtk: Visiting a website may lead to an app denial-of-service (CVE-2026-43804)
webkitgtk: Websites may know if the user has visited a given link (CVE-2026-64713)
webkitgtk: Maliciously crafted web content may violate iframe sandboxing policy (CVE-2026-64728)
webkitgtk: Processing maliciously crafted web content may lead to an unexpected process termination (CVE-2026-64787)
webkitgtk: Visiting a website that frames malicious content may lead to UI spoofing (CVE-2026-64730)
webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-64757)
webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-64783)
webkitgtk: use-after-free of JSCValue function parameters (CVE-2026-78376)
chromium-browser: Skia: Information disclosure via out-of-bounds read in crafted media file (CVE-2026-79020)
webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-43795)
webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2026-64715)
webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-64718)
webkitgtk: Visiting a maliciously crafted website may leak sensitive data (CVE-2026-64778)
webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-64779)
webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-64780)
webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-64782)
webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-64784)
webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65331)
webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65332)
webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65334)
webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65335)
webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65336)
webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65337)
webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65338)
webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65340)
webkitgtk: Processing maliciously crafted web content may lead to memory corruption (CVE-2026-65341)
webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65351)
webkitgtk: Validate the full FeatureList array once in OpenTypeVerticalData findFeature (CVE-2026-83596)
chromium-browser: skia: chromium-browser: Information leak in Skia (CVE-2026-84359)
webkitgtk: Processing maliciously crafted web content may lead to an unexpected process termination (CVE-2026-84635)
webkitgtk: Processing maliciously crafted web…

Record: RLSA-2026:69098
CVSS 3.1: 9.6 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Updated: 2026-11-02

OSVRLSA-2026:74084 9.6

Critical: webkit2gtk3 security update

WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.

Security Fix(es):

chromium-browser: skia: chromium-browser: skia: Inappropriate implementation in Skia (CVE-2023-4860)
chromium-browser: angle: Out of bounds memory access in ANGLE (CVE-2024-7532)
chromium-browser: skia: chromium-browser: skia: Out of bounds memory access in Skia in Google Chrome allows a remote attacker who had compromised the renderer process to perform out of bounds memory access via a crafted HTML page (CVE-2024-7966)
chromium: skia: chromium: skia: Heap buffer overflow in Skia (CVE-2024-8193)
chromium: skia: chromium: skia: Heap buffer overflow in Skia (CVE-2024-8198)
chromium: skia: chromium: skia: Heap buffer overflow in Skia (CVE-2024-8636)
chromium-browser: skia: chromium-browser: skia: Integer overflow in Skia in Google Chrome (CVE-2024-9123)
chromium-browser: skia: chromium-browser: skia: Integer overflow in Skia (CVE-2025-0436)
chromium-browser: skia: chromium-browser: skia: Use after free in Skia (CVE-2025-0444)
chromium-browser: angle: ANGLE Out-of-Bounds Write Vulnerability (CVE-2025-8901)
chromium-browser: angle: Use after free in ANGLE (CVE-2025-9478)
chromium-browser: angle: Heap buffer overflow in ANGLE (CVE-2025-10502)
chromium-browser: angle: Use after free in ANGLE (CVE-2026-0908)
chromium-browser: angle: Integer overflow in ANGLE (CVE-2026-3536)
chromium-browser: skia: chromium-browser: skia: Integer overflow in Skia (CVE-2026-3538)
chromium-browser: skia: chromium-browser: skia: Heap buffer overflow in Skia (CVE-2026-3931)
chromium-browser: skia: chromium-browser: skia: Out of bounds write in Skia (CVE-2026-3909)
chromium-browser: Integer overflow in ANGLE (CVE-2026-4464)
chromium-browser: Integer overflow in ANGLE (CVE-2026-4452)
chromium-browser: Heap buffer overflow in ANGLE (CVE-2026-4448)
chromium-browser: skia: chromium-browser: skia: Out of bounds read in Skia (CVE-2026-4460)
chromium-browser: Inappropriate implementation in ANGLE (CVE-2026-5283)
chromium-browser: Heap buffer overflow in ANGLE (CVE-2026-5275)
chromium-browser: Integer overflow in ANGLE (CVE-2026-5277)
chromium-browser: Heap buffer overflow in ANGLE (CVE-2026-5868)
chromium-browser: Insufficient validation of untrusted input in ANGLE (CVE-2026-5879)
chromium-browser: skia: chromium-browser: skia: Integer overflow in Skia (CVE-2026-5870)
chromium-browser: Heap buffer overflow in ANGLE (CVE-2026-6296)
chromium-browser: skia: chromium-browser: skia: Out of bounds read in Skia (CVE-2026-6364)
chromium-browser: skia: chromium-browser: skia: Heap buffer overflow in Skia (CVE-2026-6298)
chromium-browser: skia: chromium-browser: skia: Heap buffer overflow in Skia (CVE-2026-7353)
chromium-browser: Integer overflow in ANGLE (CVE-2026-7340)
chromium-browser: Use after free in ANGLE (CVE-2026-7359)
chromium-browser: Out of bounds read and write in Angle (CVE-2026-7354)
chromium-browser: Use after free in ANGLE (CVE-2026-7901)
chromium-browser: skia: chromium-browser: skia: Out of bounds read in Skia (CVE-2026-7949)
chromium-browser: Integer overflow in ANGLE (CVE-2026-7903)
chromium-browser: skia: chromium-browser: skia: Out of bounds write in Skia (CVE-2026-7923)
chromium-browser: Heap buffer overflow in ANGLE (CVE-2026-7900)
chromium-browser: skia: chromium-browser: skia: Use after free in Skia (CVE-2026-7920)
chromium-browser: angle: Integer overflow in ANGLE (CVE-2026-7942)
chromium-browser: angle: Insufficient validation of untrusted input in ANGLE (CVE-2026-7943)
chromium-browser: skia: chromium-browser: skia: Integer overflow in Skia (CVE-2026-8510)
chromium-browser: angle: chromium-browser: Heap buffer overflow in ANGLE (CVE-2026-8525)
chromium-browser: angle: chromium-browser: Type Confusion in ANGLE (CVE-2026-8554)
chromium-browser: chromium-browser: Inappropriate implementation in ANGLE…

Record: RLSA-2026:74084
CVSS 3.1: 9.6 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Updated: 2026-11-02

OSVALSA-2026:69098 No score

Important: webkit2gtk3 security update

WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.

Security Fix(es):

chromium-browser: Skia in Google Chrome: Sandbox escape via crafted HTML page (CVE-2026-19154)
chromium-browser: skia: Skia: Sandbox escape via out-of-bounds write in Chromium (CVE-2026-19173)
chromium-browser: Skia in Google Chrome: Cross-origin data leakage via uninitialized use (CVE-2026-19161)
chromium-browser: Skia: Arbitrary code execution via crafted HTML page (CVE-2026-19176)
chromium-browser: Chromium: Information leak allows web origin policy bypass (CVE-2026-76041)
webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-28984)
webkitgtk: Visiting a website may lead to an app denial-of-service (CVE-2026-43804)
webkitgtk: Websites may know if the user has visited a given link (CVE-2026-64713)
webkitgtk: Maliciously crafted web content may violate iframe sandboxing policy (CVE-2026-64728)
webkitgtk: Processing maliciously crafted web content may lead to an unexpected process termination (CVE-2026-64787)
webkitgtk: Visiting a website that frames malicious content may lead to UI spoofing (CVE-2026-64730)
webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-64757)
webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-64783)
webkitgtk: use-after-free of JSCValue function parameters (CVE-2026-78376)
chromium-browser: Skia: Information disclosure via out-of-bounds read in crafted media file (CVE-2026-79020)
webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-43795)
webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2026-64715)
webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-64718)
webkitgtk: Visiting a maliciously crafted website may leak sensitive data (CVE-2026-64778)
webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-64779)
webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-64780)
webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-64782)
webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-64784)
webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65331)
webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65332)
webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65334)
webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65335)
webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65336)
webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65337)
webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65338)
webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65340)
webkitgtk: Processing maliciously crafted web content may lead to memory corruption (CVE-2026-65341)
webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65351)
webkitgtk: Validate the full FeatureList array once in OpenTypeVerticalData findFeature (CVE-2026-83596)
chromium-browser: skia: chromium-browser: Information leak in Skia (CVE-2026-84359)
webkitgtk: Processing maliciously crafted web content may lead to an unexpected process termination (CVE-2026-84635) *…

Record: ALSA-2026:69098
Updated: 2026-11-02

OSVALSA-2026:74084 No score

Critical: webkit2gtk3 security update

WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.

Security Fix(es):

chromium-browser: skia: chromium-browser: skia: Inappropriate implementation in Skia (CVE-2023-4860)
chromium-browser: angle: Out of bounds memory access in ANGLE (CVE-2024-7532)
chromium-browser: skia: chromium-browser: skia: Out of bounds memory access in Skia in Google Chrome allows a remote attacker who had compromised the renderer process to perform out of bounds memory access via a crafted HTML page (CVE-2024-7966)
chromium: skia: chromium: skia: Heap buffer overflow in Skia (CVE-2024-8193)
chromium: skia: chromium: skia: Heap buffer overflow in Skia (CVE-2024-8198)
chromium: skia: chromium: skia: Heap buffer overflow in Skia (CVE-2024-8636)
chromium-browser: skia: chromium-browser: skia: Integer overflow in Skia in Google Chrome (CVE-2024-9123)
chromium-browser: skia: chromium-browser: skia: Integer overflow in Skia (CVE-2025-0436)
chromium-browser: skia: chromium-browser: skia: Use after free in Skia (CVE-2025-0444)
chromium-browser: angle: ANGLE Out-of-Bounds Write Vulnerability (CVE-2025-8901)
chromium-browser: angle: Use after free in ANGLE (CVE-2025-9478)
chromium-browser: angle: Heap buffer overflow in ANGLE (CVE-2025-10502)
chromium-browser: angle: Use after free in ANGLE (CVE-2026-0908)
chromium-browser: angle: Integer overflow in ANGLE (CVE-2026-3536)
chromium-browser: skia: chromium-browser: skia: Integer overflow in Skia (CVE-2026-3538)
chromium-browser: skia: chromium-browser: skia: Heap buffer overflow in Skia (CVE-2026-3931)
chromium-browser: skia: chromium-browser: skia: Out of bounds write in Skia (CVE-2026-3909)
chromium-browser: Integer overflow in ANGLE (CVE-2026-4464)
chromium-browser: Integer overflow in ANGLE (CVE-2026-4452)
chromium-browser: Heap buffer overflow in ANGLE (CVE-2026-4448)
chromium-browser: skia: chromium-browser: skia: Out of bounds read in Skia (CVE-2026-4460)
chromium-browser: Inappropriate implementation in ANGLE (CVE-2026-5283)
chromium-browser: Heap buffer overflow in ANGLE (CVE-2026-5275)
chromium-browser: Integer overflow in ANGLE (CVE-2026-5277)
chromium-browser: Heap buffer overflow in ANGLE (CVE-2026-5868)
chromium-browser: Insufficient validation of untrusted input in ANGLE (CVE-2026-5879)
chromium-browser: skia: chromium-browser: skia: Integer overflow in Skia (CVE-2026-5870)
chromium-browser: Heap buffer overflow in ANGLE (CVE-2026-6296)
chromium-browser: skia: chromium-browser: skia: Out of bounds read in Skia (CVE-2026-6364)
chromium-browser: skia: chromium-browser: skia: Heap buffer overflow in Skia (CVE-2026-6298)
chromium-browser: skia: chromium-browser: skia: Heap buffer overflow in Skia (CVE-2026-7353)
chromium-browser: Integer overflow in ANGLE (CVE-2026-7340)
chromium-browser: Use after free in ANGLE (CVE-2026-7359)
chromium-browser: Out of bounds read and write in Angle (CVE-2026-7354)
chromium-browser: Use after free in ANGLE (CVE-2026-7901)
chromium-browser: skia: chromium-browser: skia: Out of bounds read in Skia (CVE-2026-7949)
chromium-browser: Integer overflow in ANGLE (CVE-2026-7903)
chromium-browser: skia: chromium-browser: skia: Out of bounds write in Skia (CVE-2026-7923)
chromium-browser: Heap buffer overflow in ANGLE (CVE-2026-7900)
chromium-browser: skia: chromium-browser: skia: Use after free in Skia (CVE-2026-7920)
chromium-browser: angle: Integer overflow in ANGLE (CVE-2026-7942)
chromium-browser: angle: Insufficient validation of untrusted input in ANGLE (CVE-2026-7943)
chromium-browser: skia: chromium-browser: skia: Integer overflow in Skia (CVE-2026-8510)
chromium-browser: angle: chromium-browser: Heap buffer overflow in ANGLE (CVE-2026-8525)
chromium-browser: angle: chromium-browser: Type Confusion in ANGLE (CVE-2026-8554)
chromium-browser:…

Record: ALSA-2026:74084
Updated: 2026-11-02

OSVMGASA-2024-0321 No score

Updated chromium-browser-stable packages fix security vulnerabilities

Use after free in Downloads. (CVE-2024-6988) Use after free in Loader. (CVE-2024-6989) Use after free in Dawn. (CVE-2024-6991) Heap buffer overflow in Layout. (CVE-2024-6994) Inappropriate implementation in Fullscreen. (CVE-2024-6995) Race in Frames. (CVE-2024-6996) Use after free in Tabs. (CVE-2024-6997) Use after free in User Education. (CVE-2024-6998) Inappropriate implementation in FedCM. (CVE-2024-6999) Use after free in CSS. (CVE-2024-7000) Inappropriate implementation in HTML. (CVE-2024-7001) Inappropriate implementation in FedCM. (CVE-2024-7003) Insufficient validation of untrusted input in Safe Browsing. (CVE-2024-7004) Insufficient validation of untrusted input in Safe Browsing. (CVE-2024-7005) Uninitialized Use in Dawn. (CVE-2024-6990) Out of bounds read in WebTransport. (CVE-2024-7255) Insufficient data validation in Dawn. (CVE-2024-7256) Out of bounds memory access in ANGLE. (CVE-2024-7532) Use after free in Sharing. (CVE-2024-7533) Type Confusion in V8. (CVE-2024-7550) Heap buffer overflow in Layout. (CVE-2024-7534) Inappropriate implementation in V8. (CVE-2024-7535) Use after free in WebAudio. (CVE-2024-7536) Use after free in Passwords. (CVE-2024-7964) Inappropriate implementation in V8. (CVE-2024-7965) Out of bounds memory access in Skia. (CVE-2024-7966) Heap buffer overflow in Fonts. (CVE-2024-7967) Use after free in Autofill. (CVE-2024-7968) Type confusion in V8. (CVE-2024-7971) Inappropriate implementation in V8. (CVE-2024-7972) Heap buffer overflow in PDFium. (CVE-2024-7973) Insufficient data validation in V8 API. (CVE-2024-7974) Inappropriate implementation in Permissions. (CVE-2024-7975) Inappropriate implementation in FedCM. (CVE-2024-7976) Insufficient data validation in Installer. (CVE-2024-7977) Insufficient policy enforcement in Data Transfer. (CVE-2024-7978) Insufficient data validation in Installer. (CVE-2024-7979) Insufficient data validation in Installer. (CVE-2024-7980) Inappropriate implementation in Views. (CVE-2024-7981) Type Confusion in V8. (CVE-2024-7969) Heap buffer overflow in Skia. (CVE-2024-8193) Type Confusion in V8. (CVE-2024-8194) Heap buffer overflow in Skia. (CVE-2024-8198) Use after free in WebAudio. (CVE-2024-8362) Out of bounds write in V8. (CVE-2024-7970) Heap buffer overflow in Skia. (CVE-2024-8636) Use after free in Media Router. (CVE-2024-8637) Type Confusion in V8. (CVE-2024-8638) Use after free in Autofill. (CVE-2024-8639) Type Confusion in V8. (CVE-2024-8904) Inappropriate implementation in V8. (CVE-2024-8905) Incorrect security UI in Downloads. (CVE-2024-8906) Insufficient data validation in Omnibox. (CVE-2024-8907) Inappropriate implementation in Autofill. (CVE-2024-8908) Inappropriate implementation in UI. (CVE-2024-8909) Inappropriate implementation in V8. (CVE-2024-9121) Type Confusion in V8. (CVE-2024-9122) Integer overflow in Skia. (CVE-2024-9123)

Record: MGASA-2024-0321
Updated: 2026-11-02

OSVopenSUSE-SU-2024:0314-1 No score

Security update for chromium

This update for chromium fixes the following issues:

Chromium 129.0.6668.70 (stable released 2024-09-24) (boo#1230964)

CVE-2024-9120: Use after free in Dawn
CVE-2024-9121: Inappropriate implementation in V8
CVE-2024-9122: Type Confusion in V8
CVE-2024-9123: Integer overflow in Skia

bump BR for nodejs to minimal 20.0

Record: openSUSE-SU-2024:0314-1
Updated: 2026-11-02

OSVopenSUSE-SU-2024:0320-1 No score

Security update for chromium

This update for chromium fixes the following issues:

Chromium 129.0.6668.70 (stable released 2024-09-24) (boo#1230964)

CVE-2024-9120: Use after free in Dawn
CVE-2024-9121: Inappropriate implementation in V8
CVE-2024-9122: Type Confusion in V8
CVE-2024-9123: Integer overflow in Skia

Record: openSUSE-SU-2024:0320-1
Updated: 2026-11-02

OSVopenSUSE-SU-2024:14368-1 No score

chromedriver-129.0.6668.70-1.1 on GA media

These are all security issues fixed in the chromedriver-129.0.6668.70-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:14368-1
Updated: 2026-11-02

OSVopenSUSE-SU-2024:14425-1 No score

nodejs-electron-31.7.2-1.1 on GA media

These are all security issues fixed in the nodejs-electron-31.7.2-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:14425-1
Updated: 2026-11-02

OSVopenSUSE-SU-2024:14548-1 No score

libQt5Pdf5-5.15.18-1.1 on GA media

These are all security issues fixed in the libQt5Pdf5-5.15.18-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:14548-1
Updated: 2026-11-02

OSVopenSUSE-SU-2026:22076-1 No score

Security update for webkit2gtk3

This update for webkit2gtk3 fixes the following issues:

WebKitGTK and WPE WebKit Security Advisory WSA-2026-0006 (bsc#1284619):

CVE-2024-1283: Heap buffer overflow in Skia in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVE-2024-43091: Out of bounds write due to an integer overflow in filterMask of SkEmbossMaskFilter.cpp could lead to remote code execution.
CVE-2024-43097: Out of bounds write due to an integer overflow in resizeToAtLeast of SkRegion.cpp could lead to local escalation of privilege.
CVE-2024-43767: Heap overflow due to improper input validation in prepare_to_draw_into_mask of SkBlurMaskFilterImpl.cpp could lead to remote code execution.
CVE-2024-43768: Out of bounds write due to an integer overflow in skia_alloc_func of SkDeflate.cpp could lead to local escalation of privilege.
CVE-2024-7966: Out of bounds memory access in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to perform out of bounds memory access via a crafted HTML page.
CVE-2024-8193: Heap buffer overflow in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.
CVE-2024-8198: Heap buffer overflow in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.
CVE-2024-8636: Heap buffer overflow in Skia in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVE-2024-9123: Integer overflow in Skia in Google Chrome allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page.
CVE-2025-0436: Integer overflow in Skia in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVE-2025-0444: Use after free in Skia in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVE-2025-10502: Heap buffer overflow in ANGLE in Google Chrome allowed a remote attacker to potentially exploit heap corruption via malicious network traffic.
CVE-2025-26416: Out of bounds write due to a heap buffer overflow in initializeSwizzler of SkBmpStandardCodec.cpp could lead to remote escalation of privilege.
CVE-2025-32318: Out of bounds write due to a heap buffer overflow in Skia could lead to remote escalation of privilege.
CVE-2025-48622: Out of bounds read due to a buffer overflow in ProcessArea of dng_misc_opcodes.cpp could lead to local information disclosure.
CVE-2025-54627: An out-of-bounds write vulnerability in the skia module may affect service confidentiality upon successful exploitation.
CVE-2025-8901: Out of bounds write in ANGLE in Google Chrome allowed a remote attacker to perform out of bounds memory access via a crafted HTML page.
CVE-2025-9478: Use after free in ANGLE in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVE-2026-0908: Use after free in ANGLE in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVE-2026-10009: Integer overflow in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page.
CVE-2026-10011: Inappropriate implementation in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page.
CVE-2026-10012: Use after free in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
CVE-2026-10018: Integer overflow in ANGLE in Google Chrome allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. -…

Record: openSUSE-SU-2026:22076-1
Updated: 2026-11-02

OSVSUSE-SU-2026:24225-1 No score

Security update for webkit2gtk3

This update for webkit2gtk3 fixes the following issues:

WebKitGTK and WPE WebKit Security Advisory WSA-2026-0006 (bsc#1284619):

CVE-2024-1283: Heap buffer overflow in Skia in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVE-2024-43091: Out of bounds write due to an integer overflow in filterMask of SkEmbossMaskFilter.cpp could lead to remote code execution.
CVE-2024-43097: Out of bounds write due to an integer overflow in resizeToAtLeast of SkRegion.cpp could lead to local escalation of privilege.
CVE-2024-43767: Heap overflow due to improper input validation in prepare_to_draw_into_mask of SkBlurMaskFilterImpl.cpp could lead to remote code execution.
CVE-2024-43768: Out of bounds write due to an integer overflow in skia_alloc_func of SkDeflate.cpp could lead to local escalation of privilege.
CVE-2024-7966: Out of bounds memory access in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to perform out of bounds memory access via a crafted HTML page.
CVE-2024-8193: Heap buffer overflow in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.
CVE-2024-8198: Heap buffer overflow in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.
CVE-2024-8636: Heap buffer overflow in Skia in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVE-2024-9123: Integer overflow in Skia in Google Chrome allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page.
CVE-2025-0436: Integer overflow in Skia in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVE-2025-0444: Use after free in Skia in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVE-2025-10502: Heap buffer overflow in ANGLE in Google Chrome allowed a remote attacker to potentially exploit heap corruption via malicious network traffic.
CVE-2025-26416: Out of bounds write due to a heap buffer overflow in initializeSwizzler of SkBmpStandardCodec.cpp could lead to remote escalation of privilege.
CVE-2025-32318: Out of bounds write due to a heap buffer overflow in Skia could lead to remote escalation of privilege.
CVE-2025-48622: Out of bounds read due to a buffer overflow in ProcessArea of dng_misc_opcodes.cpp could lead to local information disclosure.
CVE-2025-54627: An out-of-bounds write vulnerability in the skia module may affect service confidentiality upon successful exploitation.
CVE-2025-8901: Out of bounds write in ANGLE in Google Chrome allowed a remote attacker to perform out of bounds memory access via a crafted HTML page.
CVE-2025-9478: Use after free in ANGLE in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVE-2026-0908: Use after free in ANGLE in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVE-2026-10009: Integer overflow in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page.
CVE-2026-10011: Inappropriate implementation in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page.
CVE-2026-10012: Use after free in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
CVE-2026-10018: Integer overflow in ANGLE in Google Chrome allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. -…

Record: SUSE-SU-2026:24225-1
Updated: 2026-11-02

OSVSUSE-SU-2026:4676-1 No score

Security update for webkit2gtk3

This update for webkit2gtk3 fixes the following issues:

WebKitGTK and WPE WebKit Security Advisory WSA-2026-0006 (bsc#1284619):

CVE-2024-1283: Heap buffer overflow in Skia in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVE-2024-43091: Out of bounds write due to an integer overflow in filterMask of SkEmbossMaskFilter.cpp could lead to remote code execution.
CVE-2024-43097: Out of bounds write due to an integer overflow in resizeToAtLeast of SkRegion.cpp could lead to local escalation of privilege.
CVE-2024-43767: Heap overflow due to improper input validation in prepare_to_draw_into_mask of SkBlurMaskFilterImpl.cpp could lead to remote code execution.
CVE-2024-43768: Out of bounds write due to an integer overflow in skia_alloc_func of SkDeflate.cpp could lead to local escalation of privilege.
CVE-2024-7966: Out of bounds memory access in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to perform out of bounds memory access via a crafted HTML page.
CVE-2024-8193: Heap buffer overflow in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.
CVE-2024-8198: Heap buffer overflow in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.
CVE-2024-8636: Heap buffer overflow in Skia in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVE-2024-9123: Integer overflow in Skia in Google Chrome allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page.
CVE-2025-0436: Integer overflow in Skia in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVE-2025-0444: Use after free in Skia in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVE-2025-10502: Heap buffer overflow in ANGLE in Google Chrome allowed a remote attacker to potentially exploit heap corruption via malicious network traffic.
CVE-2025-26416: Out of bounds write due to a heap buffer overflow in initializeSwizzler of SkBmpStandardCodec.cpp could lead to remote escalation of privilege.
CVE-2025-32318: Out of bounds write due to a heap buffer overflow in Skia could lead to remote escalation of privilege.
CVE-2025-48622: Out of bounds read due to a buffer overflow in ProcessArea of dng_misc_opcodes.cpp could lead to local information disclosure.
CVE-2025-54627: An out-of-bounds write vulnerability in the skia module may affect service confidentiality upon successful exploitation.
CVE-2025-8901: Out of bounds write in ANGLE in Google Chrome allowed a remote attacker to perform out of bounds memory access via a crafted HTML page.
CVE-2025-9478: Use after free in ANGLE in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVE-2026-0908: Use after free in ANGLE in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVE-2026-10009: Integer overflow in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page.
CVE-2026-10011: Inappropriate implementation in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page.
CVE-2026-10012: Use after free in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
CVE-2026-10018: Integer overflow in ANGLE in Google Chrome allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. -…

Record: SUSE-SU-2026:4676-1
Updated: 2026-11-02

OSVSUSE-SU-2026:4858-1 No score

Security update for webkit2gtk3

This update for webkit2gtk3 fixes the following issues:

Security issues fixed:

WebKitGTK and WPE WebKit Security Advisory WSA-2026-0006 (bsc#1284619):

CVE-2024-1283: Heap buffer overflow in Skia in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVE-2024-43091: Out of bounds write due to an integer overflow in filterMask of SkEmbossMaskFilter.cpp could lead to remote code execution.
CVE-2024-43097: Out of bounds write due to an integer overflow in resizeToAtLeast of SkRegion.cpp could lead to local escalation of privilege.
CVE-2024-43767: Heap overflow due to improper input validation in prepare_to_draw_into_mask of SkBlurMaskFilterImpl.cpp could lead to remote code execution.
CVE-2024-43768: Out of bounds write due to an integer overflow in skia_alloc_func of SkDeflate.cpp could lead to local escalation of privilege.
CVE-2024-7966: Out of bounds memory access in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to perform out of bounds memory access via a crafted HTML page.
CVE-2024-8193: Heap buffer overflow in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.
CVE-2024-8198: Heap buffer overflow in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.
CVE-2024-8636: Heap buffer overflow in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.
CVE-2024-9123: Integer overflow in Skia in Google Chrome allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page.
CVE-2025-0436: Integer overflow in Skia in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVE-2025-0444: Use after free in Skia in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVE-2025-10502: Heap buffer overflow in ANGLE in Google Chrome allowed a remote attacker to potentially exploit heap corruption via malicious network traffic.
CVE-2025-26416: Out of bounds write due to a heap buffer overflow in initializeSwizzler of SkBmpStandardCodec.cpp could lead to remote escalation of privilege.
CVE-2025-32318: Out of bounds write due to a heap buffer overflow in Skia could lead to remote escalation of privilege.
CVE-2025-48622: Out of bounds read due to a buffer overflow in ProcessArea of dng_misc_opcodes.cpp could lead to local information disclosure.
CVE-2025-54627: An out-of-bounds write vulnerability in the skia module may affect service confidentiality upon successful exploitation.
CVE-2025-8901: Out of bounds write in ANGLE in Google Chrome allowed a remote attacker to perform out of bounds memory access via a crafted HTML page.
CVE-2025-9478: Use after free in ANGLE in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVE-2026-0908: Use after free in ANGLE in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVE-2026-10009: Integer overflow in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page.
CVE-2026-10011: Inappropriate implementation in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page.
CVE-2026-10012: Use after free in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
CVE-2026-10018: Integer overflow in ANGLE in Google Chrome allowed a…

Record: SUSE-SU-2026:4858-1
Updated: 2026-11-02

Affected products

google chrome

Affected packages

Affected packages
Package	Affected	Fixed
`qt5-qtwebengine` Alpine:v3.20	before 5.15.16-r12	5.15.16-r12
`qt5-qtwebengine` Alpine:v3.21	before 5.15.17-r3	5.15.17-r3
`qt5-qtwebengine` Alpine:v3.22	before 5.15.17-r3	5.15.17-r3
`qt5-qtwebengine` Alpine:v3.23	before 5.15.17-r3	5.15.17-r3
`qt6-qtwebengine` Alpine:v3.21	before 6.7.2-r6	6.7.2-r6
`qt6-qtwebengine` Alpine:v3.22	before 6.7.2-r6	6.7.2-r6
`qt6-qtwebengine` Alpine:v3.23	before 6.7.2-r6	6.7.2-r6
`qt6-qtwebengine` Alpine:v3.24	before 6.7.2-r6	6.7.2-r6
`webkit2gtk3` AlmaLinux:9	before 2.54.0-1.el9_8	2.54.0-1.el9_8
`webkit2gtk3-devel` AlmaLinux:9	before 2.54.0-1.el9_8	2.54.0-1.el9_8

Show 75 moreShow less

Affected packages
Package	Affected	Fixed
`webkit2gtk3-jsc` AlmaLinux:9	before 2.54.0-1.el9_8	2.54.0-1.el9_8
`webkit2gtk3-jsc-devel` AlmaLinux:9	before 2.54.0-1.el9_8	2.54.0-1.el9_8
`webkit2gtk3` AlmaLinux:8	before 2.54.0-1.el8_10	2.54.0-1.el8_10
`webkit2gtk3-devel` AlmaLinux:8	before 2.54.0-1.el8_10	2.54.0-1.el8_10
`webkit2gtk3-jsc` AlmaLinux:8	before 2.54.0-1.el8_10	2.54.0-1.el8_10
`webkit2gtk3-jsc-devel` AlmaLinux:8	before 2.54.0-1.el8_10	2.54.0-1.el8_10
`chromium` Debian:12	before 129.0.6668.70-1~deb12u1, plus listed versions 113.0.5672.126-1114.0.5735.106-1114.0.5735.106-1~deb11u1114.0.5735.106-1~deb12u1114.0.5735.133-1 Show 45 moreShow less 114.0.5735.133-1~deb11u1114.0.5735.133-1~deb12u1114.0.5735.198-1114.0.5735.198-1~deb11u1114.0.5735.198-1~deb12u1114.0.5735.90-1114.0.5735.90-2114.0.5735.90-2~deb11u1114.0.5735.90-2~deb12u1115.0.5790.102-1115.0.5790.102-2115.0.5790.170-1115.0.5790.170-1~deb11u1115.0.5790.170-1~deb12u1115.0.5790.98-1115.0.5790.98-1~deb11u1115.0.5790.98-1~deb12u1115.0.5790.98-2116.0.5845.110-1116.0.5845.110-1~deb11u1116.0.5845.110-1~deb12u1116.0.5845.110-2116.0.5845.140-1116.0.5845.140-1~deb11u1116.0.5845.140-1~deb12u1116.0.5845.180-1116.0.5845.180-1~deb11u1116.0.5845.180-1~deb12u1116.0.5845.96-1116.0.5845.96-1~deb11u1116.0.5845.96-1~deb12u1116.0.5845.96-2117.0.5938.132-1117.0.5938.132-1~deb11u1117.0.5938.132-1~deb12u1117.0.5938.132-2117.0.5938.149-1117.0.5938.149-1~deb11u1117.0.5938.149-1~deb12u1117.0.5938.62-1117.0.5938.62-1~deb11u1117.0.5938.62-1~deb12u1117.0.5938.92-1118.0.5993.117-1118.0.5993.117-1~deb11u1	129.0.6668.70-1~deb12u1
`chromium` Debian:13	before 129.0.6668.70-1	129.0.6668.70-1
`chromium` Debian:14	before 129.0.6668.70-1	129.0.6668.70-1
`webkit2gtk` Debian:12	All versions, plus listed versions 2.40.1-12.40.2-12.40.2-1~deb11u12.40.2-1~deb12u12.40.3-1 Show 45 moreShow less 2.40.3-22.40.3-2~deb11u12.40.3-2~deb11u22.40.3-2~deb12u12.40.3-2~deb12u22.40.4-12.40.5-12.40.5-1~deb11u12.40.5-1~deb12u12.41.4-12.41.5-12.41.6-12.41.90-12.41.91-12.41.91-22.41.92-12.42.0-12.42.0-1~bpo12+12.42.1-12.42.1-1~bpo12+12.42.1-1~deb11u12.42.1-1~deb11u22.42.1-1~deb12u12.42.1-22.42.2-12.42.2-1~deb11u12.42.2-1~deb12u12.42.3-12.42.3-1~deb11u12.42.3-1~deb12u12.42.4-12.42.4-1~deb11u12.42.4-1~deb12u12.42.5-12.42.5-1~deb11u12.42.5-1~deb12u12.42.5-22.43.1-12.43.2-12.43.3-12.43.4-12.43.4-22.44.0-12.44.0-22.44.1-1	None known
`webkit2gtk` Debian:13	before 2.54.0-1~deb13u1, plus listed versions 2.48.3-12.48.5-12.48.5-1~deb11u12.48.5-1~deb12u12.48.5-1~deb13u1 Show 45 moreShow less 2.48.6-12.49.90-12.50.0-12.50.0-22.50.1-12.50.1-1~deb11u12.50.1-1~deb12u12.50.1-1~deb13u12.50.2-12.50.2-1~deb11u12.50.2-1~deb12u12.50.2-1~deb13u12.50.3-12.50.3-1+hurd.12.50.3-1~deb11u12.50.3-1~deb12u12.50.3-1~deb13u12.50.4-12.50.4-1~deb11u12.50.4-1~deb12u12.50.4-1~deb13u12.50.5-12.50.6-12.50.6-1~deb11u12.50.6-1~deb12u12.50.6-1~deb12u22.50.6-1~deb13u12.51.1-12.51.2-12.51.3-12.51.4-12.51.90-12.51.91-12.51.92-12.51.93-12.52.0-12.52.1-12.52.2-12.52.2-22.52.3-12.52.3-22.52.3-2~deb13u12.52.4-12.52.5-12.52.5-1~deb13u1	2.54.0-1~deb13u1
`webkit2gtk` Debian:14	All versions, plus listed versions 2.48.3-12.48.5-12.48.5-1~deb11u12.48.5-1~deb12u12.48.5-1~deb13u1 Show 45 moreShow less 2.48.6-12.49.90-12.50.0-12.50.0-22.50.1-12.50.1-1~deb11u12.50.1-1~deb12u12.50.1-1~deb13u12.50.2-12.50.2-1~deb11u12.50.2-1~deb12u12.50.2-1~deb13u12.50.3-12.50.3-1+hurd.12.50.3-1~deb11u12.50.3-1~deb12u12.50.3-1~deb13u12.50.4-12.50.4-1~deb11u12.50.4-1~deb12u12.50.4-1~deb13u12.50.5-12.50.6-12.50.6-1~deb11u12.50.6-1~deb12u12.50.6-1~deb12u22.50.6-1~deb13u12.51.1-12.51.2-12.51.3-12.51.4-12.51.90-12.51.91-12.51.92-12.51.93-12.52.0-12.52.1-12.52.2-12.52.2-22.52.3-12.52.3-22.52.3-2~deb13u12.52.4-12.52.5-12.52.5-1~deb13u1	None known
`wpewebkit` Debian:12	All versions, plus listed versions 2.38.6-12.39.91-12.40.0-12.40.1-12.40.2-1 Show 45 moreShow less 2.40.2-22.40.3-12.40.4-12.40.5-12.42.0-12.42.1-12.42.2-12.42.3-12.42.4-12.42.5-12.42.5-1.12.42.5-1.1~exp12.42.5-1.22.42.5-2~exp2.44.1-12.44.2-12.44.2-22.44.3-12.44.4-12.46.1-12.46.2-12.46.3-12.46.4-12.46.5-12.46.6-12.48.0-12.48.1-12.48.1-22.48.2-12.48.3-12.48.5-12.48.6-12.48.6-22.50.0-12.50.0-22.50.1-12.50.2-12.50.3-12.50.4-12.50.5-12.50.6-12.52.0-12.52.1-12.52.2-12.52.2-2	None known
`wpewebkit` Debian:13	All versions, plus listed versions 2.48.3-12.48.5-12.48.6-12.48.6-22.50.0-1 Show 19 moreShow less 2.50.0-22.50.1-12.50.2-12.50.3-12.50.4-12.50.5-12.50.6-12.52.0-12.52.1-12.52.2-12.52.2-22.52.3-12.52.4-12.52.5-12.52.6-12.54.0-12.54.0-22.54.1-12.54.2-1	None known
`wpewebkit` Debian:14	before 2.54.0-1, plus listed versions 2.48.3-12.48.5-12.48.6-12.48.6-22.50.0-1 Show 15 moreShow less 2.50.0-22.50.1-12.50.2-12.50.3-12.50.4-12.50.5-12.50.6-12.52.0-12.52.1-12.52.2-12.52.2-22.52.3-12.52.4-12.52.5-12.52.6-1	2.54.0-1
`chromium-browser-stable` Mageia:9	before 128.0.6613.137-1.mga9.tainted	128.0.6613.137-1.mga9.tainted
`webkit2gtk3` Red Hat:enterprise_linux:8::appstream	before 0:2.54.0-1.el8_10	0:2.54.0-1.el8_10
`webkit2gtk3-debuginfo` Red Hat:enterprise_linux:8::appstream	before 0:2.54.0-1.el8_10	0:2.54.0-1.el8_10
`webkit2gtk3-debugsource` Red Hat:enterprise_linux:8::appstream	before 0:2.54.0-1.el8_10	0:2.54.0-1.el8_10
`webkit2gtk3-devel` Red Hat:enterprise_linux:8::appstream	before 0:2.54.0-1.el8_10	0:2.54.0-1.el8_10
`webkit2gtk3-devel-debuginfo` Red Hat:enterprise_linux:8::appstream	before 0:2.54.0-1.el8_10	0:2.54.0-1.el8_10
`webkit2gtk3-jsc` Red Hat:enterprise_linux:8::appstream	before 0:2.54.0-1.el8_10	0:2.54.0-1.el8_10
`webkit2gtk3-jsc-debuginfo` Red Hat:enterprise_linux:8::appstream	before 0:2.54.0-1.el8_10	0:2.54.0-1.el8_10
`webkit2gtk3-jsc-devel` Red Hat:enterprise_linux:8::appstream	before 0:2.54.0-1.el8_10	0:2.54.0-1.el8_10
`webkit2gtk3-jsc-devel-debuginfo` Red Hat:enterprise_linux:8::appstream	before 0:2.54.0-1.el8_10	0:2.54.0-1.el8_10
`webkit2gtk3` Rocky Linux:9	before 0:2.54.0-1.el9_8	0:2.54.0-1.el9_8
`webkit2gtk3` Rocky Linux:8	before 0:2.54.0-1.el8_10	0:2.54.0-1.el8_10
`webkit2gtk3` SUSE:Linux Enterprise Server 16.0	before 2.54.1-160000.1.1	2.54.1-160000.1.1
`webkit2gtk4` SUSE:Linux Enterprise Server 16.0	before 2.54.1-160000.1.1	2.54.1-160000.1.1
`webkit2gtk3` SUSE:Linux Enterprise Server for SAP applications 16.0	before 2.54.1-160000.1.1	2.54.1-160000.1.1
`webkit2gtk4` SUSE:Linux Enterprise Server for SAP applications 16.0	before 2.54.1-160000.1.1	2.54.1-160000.1.1
`webkit2gtk3` SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS	before 2.54.1-150400.4.152.2	2.54.1-150400.4.152.2
`webkit2gtk3-soup2` SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS	before 2.54.1-150400.4.152.2	2.54.1-150400.4.152.2
`webkit2gtk4` SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS	before 2.54.1-150400.4.152.2	2.54.1-150400.4.152.2
`webkit2gtk3` SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS	before 2.54.1-150400.4.152.2	2.54.1-150400.4.152.2
`webkit2gtk3-soup2` SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS	before 2.54.1-150400.4.152.2	2.54.1-150400.4.152.2
`webkit2gtk4` SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS	before 2.54.1-150400.4.152.2	2.54.1-150400.4.152.2
`webkit2gtk3` SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS	before 2.54.1-150400.4.152.2	2.54.1-150400.4.152.2
`webkit2gtk3-soup2` SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS	before 2.54.1-150400.4.152.2	2.54.1-150400.4.152.2
`webkit2gtk4` SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS	before 2.54.1-150400.4.152.2	2.54.1-150400.4.152.2
`webkit2gtk3` SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS	before 2.54.1-150400.4.152.2	2.54.1-150400.4.152.2
`webkit2gtk3-soup2` SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS	before 2.54.1-150400.4.152.2	2.54.1-150400.4.152.2
`webkit2gtk4` SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS	before 2.54.1-150400.4.152.2	2.54.1-150400.4.152.2
`webkit2gtk3` SUSE:Linux Enterprise Server 15 SP4-LTSS	before 2.54.1-150400.4.152.2	2.54.1-150400.4.152.2
`webkit2gtk3-soup2` SUSE:Linux Enterprise Server 15 SP4-LTSS	before 2.54.1-150400.4.152.2	2.54.1-150400.4.152.2
`webkit2gtk4` SUSE:Linux Enterprise Server 15 SP4-LTSS	before 2.54.1-150400.4.152.2	2.54.1-150400.4.152.2
`webkit2gtk3` SUSE:Linux Enterprise Server 15 SP5-LTSS	before 2.54.1-150400.4.152.2	2.54.1-150400.4.152.2
`webkit2gtk3-soup2` SUSE:Linux Enterprise Server 15 SP5-LTSS	before 2.54.1-150400.4.152.2	2.54.1-150400.4.152.2
`webkit2gtk4` SUSE:Linux Enterprise Server 15 SP5-LTSS	before 2.54.1-150400.4.152.2	2.54.1-150400.4.152.2
`webkit2gtk3` SUSE:Linux Enterprise Server for SAP Applications 15 SP4	before 2.54.1-150400.4.152.2	2.54.1-150400.4.152.2
`webkit2gtk3-soup2` SUSE:Linux Enterprise Server for SAP Applications 15 SP4	before 2.54.1-150400.4.152.2	2.54.1-150400.4.152.2
`webkit2gtk4` SUSE:Linux Enterprise Server for SAP Applications 15 SP4	before 2.54.1-150400.4.152.2	2.54.1-150400.4.152.2
`webkit2gtk3` SUSE:Linux Enterprise Server for SAP Applications 15 SP5	before 2.54.1-150400.4.152.2	2.54.1-150400.4.152.2
`webkit2gtk3-soup2` SUSE:Linux Enterprise Server for SAP Applications 15 SP5	before 2.54.1-150400.4.152.2	2.54.1-150400.4.152.2
`webkit2gtk4` SUSE:Linux Enterprise Server for SAP Applications 15 SP5	before 2.54.1-150400.4.152.2	2.54.1-150400.4.152.2
`webkit2gtk3-soup2` SUSE:Linux Enterprise Module for Basesystem 15 SP7	before 2.54.1-150600.12.81.4	2.54.1-150600.12.81.4
`webkit2gtk4` SUSE:Linux Enterprise Module for Basesystem 15 SP7	before 2.54.1-150600.12.81.4	2.54.1-150600.12.81.4
`webkit2gtk3` SUSE:Linux Enterprise Module for Desktop Applications 15 SP7	before 2.54.1-150600.12.81.3	2.54.1-150600.12.81.3
`webkit2gtk4` SUSE:Linux Enterprise Module for Development Tools 15 SP7	before 2.54.1-150600.12.81.4	2.54.1-150600.12.81.4
`webkit2gtk3` SUSE:Linux Enterprise Server 15 SP6-LTSS	before 2.54.1-150600.12.81.3	2.54.1-150600.12.81.3
`webkit2gtk3-soup2` SUSE:Linux Enterprise Server 15 SP6-LTSS	before 2.54.1-150600.12.81.4	2.54.1-150600.12.81.4
`webkit2gtk4` SUSE:Linux Enterprise Server 15 SP6-LTSS	before 2.54.1-150600.12.81.4	2.54.1-150600.12.81.4
`webkit2gtk3` SUSE:Linux Enterprise Server for SAP Applications 15 SP6	before 2.54.1-150600.12.81.3	2.54.1-150600.12.81.3
`webkit2gtk3-soup2` SUSE:Linux Enterprise Server for SAP Applications 15 SP6	before 2.54.1-150600.12.81.4	2.54.1-150600.12.81.4
`webkit2gtk4` SUSE:Linux Enterprise Server for SAP Applications 15 SP6	before 2.54.1-150600.12.81.4	2.54.1-150600.12.81.4
`chromium` SUSE:Package Hub 15 SP6	before 129.0.6668.70-bp156.2.32.1	129.0.6668.70-bp156.2.32.1
`chromium` openSUSE:Leap 15.6	before 129.0.6668.70-bp156.2.32.1	129.0.6668.70-bp156.2.32.1
`chromium` SUSE:Package Hub 15 SP5	before 129.0.6668.70-bp155.2.120.1	129.0.6668.70-bp155.2.120.1
`chromium` openSUSE:Leap 15.5	before 129.0.6668.70-bp155.2.120.1	129.0.6668.70-bp155.2.120.1
`chromium` openSUSE:Tumbleweed	before 129.0.6668.70-1.1	129.0.6668.70-1.1
`nodejs-electron` openSUSE:Tumbleweed	before 31.7.2-1.1	31.7.2-1.1
`libqt5-qtwebengine` openSUSE:Tumbleweed	before 5.15.18-1.1	5.15.18-1.1
`webkit2gtk3` openSUSE:Leap 16.0	before 2.54.1-160000.1.1	2.54.1-160000.1.1
`webkit2gtk3-soup2` openSUSE:Leap 16.0	before 2.54.1-160000.1.1	2.54.1-160000.1.1
`webkit2gtk4` openSUSE:Leap 16.0	before 2.54.1-160000.1.1	2.54.1-160000.1.1

History

History
Recorded	Changed	Sources
Nov 4, 2026	facts
Nov 3, 2026	affected, aliases, references	OSV
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-9123 is a high vulnerability (CVSS 8.8) in Google Chrome, published September 24, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.48%, the 41st percentile. Fixed in qt5-qtwebengine 5.15.16-r12.

References

Show 194 moreShow less

This page doesn't list everything

Left out here: 263 versions, 2,166 references and the rest of 8 source descriptions. The JSON record has them.