CVE-2024-2887
HIGH 7.7EPSS 17.9%
Type Confusion in WebAssembly in Google Chrome prior to 123.0.6312.86 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)
- Affected
- Google · Chrome
- CVSS v3.1 NVD
- 7.7 HIGH
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H - CVSS v3.1 CNA
- 8.1 HIGH
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H - EPSS
- 17.92% chance of exploitation in the next 30 days, 97th percentile
- Published
- 2024-03-26
- Updated
- 2025-03-28
Proof-of-concept exploits (7)
- AabyssZG/Chrome-RCE-Poc92★ · 2024-08-24
- PumpkinBridge/Chrome-CVE-2024-2887-RCE-POC16★ · 2024-08-25
- jjyuorg/reproduce-cve-2024-28871★ · 2025-05-18
- rycbar77/CVE-2024-288718★ · 2024-08-25
- ad3210/CVE-2024-2887-REPORT0★ · 2026-06-11
- liao1123/auto_build_exploitbench_pipline0★ · 2026-08-31
- jamezx32/CVE-2024-2887
Security advisories
- https://www.zerodayinitiative.com/blog/2024/5/2/cve-2024-2887-a-pwn2own-winning-bug-in-go…
- https://chromereleases.googleblog.com/2024/03/stable-channel-update-for-desktop_26.html
- https://issues.chromium.org/issues/330588502