CVE-2024-9964: Google Chrome Payments UI Spoofing Flaw

CVE-2024-9964 Overview

CVE-2024-9964 is a user interface (UI) spoofing vulnerability in the Payments component of Google Chrome versions prior to 130.0.6723.58. A remote attacker who convinces a user to install a crafted Chrome Extension and perform specific UI gestures can spoof legitimate payment interface elements. The flaw is categorized as a User Interface Confusion issue and was rated Low severity by the Chromium project. Google addressed the issue in the Chrome Stable channel update released on October 15, 2024.

Critical Impact
Attackers can spoof payment-related UI elements through a malicious extension, potentially misleading users during sensitive financial transactions.

Affected Products

Google Chrome for Desktop prior to 130.0.6723.58
Chromium-based browsers incorporating the vulnerable Payments component
Deployments that permit installation of third-party Chrome Extensions

Discovery Timeline

2024-10-15 - Google releases Chrome Stable channel update 130.0.6723.58 addressing the issue
2024-10-15 - CVE-2024-9964 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-9964

Vulnerability Analysis

The vulnerability resides in Chrome's Payments subsystem, which renders payment sheets, autofill prompts, and related transaction UI. An inappropriate implementation permits a crafted Chrome Extension to influence how this UI is drawn or interacted with. When a user performs specific gestures, the extension can overlay or mimic trusted payment surfaces. This creates a User Interface Confusion condition [NVD-CWE-noinfo] that undermines the visual integrity users rely on during checkout.

Exploitation requires user interaction on two levels. First, the victim must install the malicious extension from a source they trust. Second, the victim must perform the gestures that trigger the spoofed UI flow. The attacker cannot execute arbitrary code, read cross-origin data, or crash the browser through this issue alone.

The practical risk is deception rather than compromise. A convincing spoof can persuade users to authorize payments, disclose card data, or approve transactions they would otherwise reject. See the Chromium Issue #361711121 tracker entry for the upstream discussion.

Root Cause

The root cause is an implementation defect in how the Payments component enforces UI trust boundaries against extension-supplied content. The renderer does not fully isolate extension-controlled elements from payment surfaces during specific interaction sequences.

Attack Vector

The attack vector is network-based delivery of a malicious Chrome Extension combined with required user interaction. An attacker publishes or side-loads a crafted extension, then lures the victim into performing gestures that invoke the payment flow. The vulnerability affects integrity of displayed content but does not directly expose confidential data or affect availability.

No verified proof-of-concept code is available for CVE-2024-9964. Technical specifics remain restricted in the Chromium issue tracker per Google's standard practice for browser vulnerabilities.

Detection Methods for CVE-2024-9964

Indicators of Compromise

Installation of unverified or newly published Chrome Extensions requesting broad host permissions or access to payment-related domains
Chrome versions below 130.0.6723.58 reported by endpoint inventory tools
User reports of payment prompts appearing outside expected checkout flows

Detection Strategies

Inventory installed Chrome Extensions across managed endpoints and compare extension IDs against an allowlist
Alert on Chrome browser versions older than 130.0.6723.58 using endpoint telemetry
Correlate extension install events with subsequent navigation to e-commerce or payment processor domains

Monitoring Recommendations

Ingest browser and extension telemetry into a centralized data lake for continuous version and extension posture review
Monitor Chrome Web Store extension reputation changes and remove revoked or flagged extensions promptly
Track user-reported phishing or spoofing incidents involving payment interfaces to identify affected populations

How to Mitigate CVE-2024-9964

Immediate Actions Required

Update Google Chrome to version 130.0.6723.58 or later on all managed endpoints
Audit installed Chrome Extensions and remove any that are unnecessary, unverified, or request excessive permissions
Communicate to users the importance of verifying payment prompts and reporting anomalies

Patch Information

Google addressed CVE-2024-9964 in the Chrome Stable channel update 130.0.6723.58 for Windows, macOS, and Linux. See the Google Chrome Stable Update advisory for the full release notes. Chromium-based browsers should be updated to a build incorporating the corresponding Chromium fix.

Workarounds

Enforce an extension allowlist through the ExtensionInstallAllowlist and ExtensionInstallBlocklist enterprise policies
Disable third-party extension installation for user populations that do not require it
Require users to complete payments through hardened, managed browser profiles where extensions are restricted

bash

# Example Chrome enterprise policy (Windows registry) restricting extensions
reg add "HKLM\Software\Policies\Google\Chrome\ExtensionInstallBlocklist" /v 1 /t REG_SZ /d "*" /f
reg add "HKLM\Software\Policies\Google\Chrome\ExtensionInstallAllowlist" /v 1 /t REG_SZ /d "<approved-extension-id>" /f