CVE-2024-2887

Type Confusion in WebAssembly in Google Chrome prior to 123.0.6312.86 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

CVSS v3.1

7.7 HIGHCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

CVSS v3.1

8.1 HIGHCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

EPSS

17.92% chance of exploitation in the next 30 days, 97th percentile

Published

2024-03-26

Updated

2025-03-28

Proof-of-concept exploits (6)

• AabyssZG/Chrome-RCE-Poc93★ · 2024-08-24
• PumpkinBridge/Chrome-CVE-2024-2887-RCE-POC16★ · 2024-08-25
• jjyuorg/reproduce-cve-2024-28871★ · 2025-05-18
• rycbar77/CVE-2024-288718★ · 2024-08-25
• ad3210/CVE-2024-2887-REPORT
• liao1123/auto_build_exploitbench_pipline

References

• CVE Record
• NVD entry

Related

• CVE-2023-4542
• CVE-2024-38063
• CVE-2024-44902
• CVE-2022-1310
• CVE-2023-2033
• CVE-2023-4427