CVE-2024-21640Active Exploitation(chromiumembedded / chromium_embedded_framework)

MEDIUMCVSS 9.6 · CRITICAL

Exploitation ongoing with high activity in latest observed window (1 mentions)

Immediate actions

Prioritize remediation for chromiumembedded chromium_embedded_framework systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft
Track advisory updates for patch or workaround availability

Recommended action window: Immediate (within 24h)

NVD description

Chromium Embedded Framework (CEF) is a simple framework for embedding Chromium-based browsers in other applications.`CefVideoConsumerOSR::OnFrameCaptured` does not check `pixel_format` properly, which leads to out-of-bounds read out of the sandbox. This vulnerability was patched in commit 1f55d2e.

chromiumembedded CVEs Back to dashboard

5.0/ 10 priority

Sources & remediation

Patch / fix

Exploit / PoC references

Weakness type (CWE)

CWE-125

Priority

MEDIUM

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

chromium_embedded_framework

Threat summary

Active exploitation appears in 1 classified signals
Public PoC is present in monitored signal
1 mentions across 1 observed day

What's happening

Active exploitation reported across 1 signal
PoC mentioned or linked in 1 signal
1 total mentions across 1 day

Affected systems

Vendors

chromiumembedded

Products

chromium_embedded_framework

Deep dive

Activity timeline1 mentions / 1d

Signal classification1 categories

Active Exploitation

1100.0%

Referenced assets1 URL

By indicator

https://aviatrix.ai/threat-research-center/shinyhunters-hacked-clop-ransomware-victims-2026

Full discourse1 post

Aviatrix Threat Research Center@aviatrixtrc46d
Active Exploitation
ShinyHunters exploited CVE-2024-21640 in Clop's dark web leak site, escalating from CMS access to steal victim payment records and operational data. The attackers now threaten to re-extort companies that previously paid Clop ransoms. Runtime segmentation of management infrastructure helps limit such lateral movement scenarios. #ThreatIntel 🔗 Full TRC analysis: https://aviatrix.ai/threat-research-center/shinyhunters-hacked-clop-ransomware-victims-2026
Post summary
ShinyHunters exploited CVE-2024-21640 against Clop's dark web leak site to escalate access, steal payment records, and threaten re-extortion; runtime segmentation of management infrastructure is recommended to limit lateral movement.
0000090
2.0K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	chromiumembedded	chromium_embedded_framework	-	-	-

Explore more

Back to dashboard chromiumembedded CVEs chromium_embedded_framework vulnerabilities