CVE-2024-10668

CVE-2024-10668 affects Google's Quick Share feature on Windows. It involves an authentication bypass that allows an attacker to send unauthorized files to a target device without the recipient's explicit approval. This vulnerability stems from the way Quick Share handles file transfers, specifically related to the processing of Payload Transfer frames. The vulnerability arises because Quick Share doesn't properly handle the deletion of unknown file types when two Payload Transfer frames of type FILE are sent with the same payload ID. The deletion logic only removes the first file, leaving the second one, which could be a malicious file, on the system. This can also be exploited to cause a denial-of-service (DoS) condition by using a filename that starts with an invalid UTF8 continuation byte. Google has addressed this vulnerability in Quick Share for Windows version 1.0.2002.2.