🛡️ CVE-2024-0805 on Debian — chromium

Distribution advisory

This page covers CVE-2024-0805 as tracked by Debian, for the package chromium. The fix is available in version 121.0.6167.85-1; earlier versions remain affected.

How this vulnerability can be exploited

This issue can be reached over the network, attack complexity is low, an attacker needs no privileges on the target. A user must be tricked into taking some action. The scope is unchanged, so the impact stays within the vulnerable component. Rated impact: confidentiality none, integrity low, availability none.

CVSS metrics in full

The score comes from this vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

• Attack vector: Network — reachable from anywhere that can route to the service.
• Attack complexity: Low — the attack works reliably, with no preparation.
• Privileges required: None — an unauthenticated stranger can try it.
• User interaction: Required — someone has to click, open or visit something.
• Scope: Unchanged — the damage stays inside the vulnerable component.
• Confidentiality impact: None.
• Integrity impact: Low — limited, and the attacker does not choose what is affected.
• Availability impact: None.

Weakness class

DEBIAN-CVE-2024-0805 is classified as CWE-451: User Interface (UI) Misrepresentation of Critical Information. The user interface (UI) does not properly represent critical information to the user, allowing the information - or its source - to be obscured or spoofed. This is often a component in phishing attacks.

Affected software

DEBIAN-CVE-2024-0805 is recorded against 1 package.

• chromium (fixed in 121.0.6167.85-1)

Timeline and source

Published on 24 January 2024 and last revised on 4 August 2026. No public exploit is currently recorded for this entry. Record sourced from OSV.

References

security-tracker.debian.org (Advisory)

Other advisories for this package

chromium has other advisories on record. If you are patching this one, these are worth checking on the same host:

• CGA-jrvh-f839-jc6g (published 11 Aug 2026)
• CGA-gxfc-g99x-63w6 (published 11 Aug 2026)
• CGA-mrhx-734h-5hqf (published 11 Aug 2026)
• CGA-2964-rrpr-v9w7 (published 11 Aug 2026)
• CGA-p9j9-wfh4-9mrf (published 11 Aug 2026)
• CGA-92c4-hwh7-mcjf (published 11 Aug 2026)
• CGA-5r8r-79h5-8vcf (published 11 Aug 2026)
• CGA-3jhv-cm94-q4cg (published 11 Aug 2026)

Same weakness in other software

These advisories are the same class of weakness (CWE-451: User Interface (UI) Misrepresentation of Critical Information) in other software:

• CVE-2026-18487 (5.4 Medium, published 6 Aug 2026)
• CVE-2026-17755 (4.3 Medium, published 30 Jul 2026)
• CVE-2026-17964 (4.3 Medium, published 30 Jul 2026)
• CVE-2026-17828 (6.5 Medium, published 30 Jul 2026)
• CVE-2026-18003 (4.3 Medium, published 30 Jul 2026)
• CVE-2026-17874 (5.4 Medium, published 30 Jul 2026)
• CVE-2026-18018 (4.0 Medium, published 30 Jul 2026)
• CVE-2026-17958 (4.3 Medium, published 30 Jul 2026)

CVE-2024-0805 on other distributions

Each distribution ships its own build and its own fixed version. Pick the one you run:

Details

Affected Packages

References