Skip to content
Threat Feed
Subscribe
high advisory

Yandex Browser: DLL hijacking vulnerability (CVE-2024-6473)

CVE-2024-6473 is a DLL hijacking vulnerability in Yandex Browser for Desktop versions prior to 24.7.1.380, allowing local code execution via an untrusted search path.

CVE search metadata

CVE search record: CVE-2024-6473. Severity: high. CVSS: 7.8. EPSS: 0.71%. KEV: no. Product: Yandex Browser (< 24.7.1.380). Brief: Yandex Browser: DLL hijacking vulnerability (CVE-2024-6473). Brief link: https://feed.craftedsignal.io/briefs/2026-11-cve-2024-6473-yandex/

Triage facts

Revision 1
Applicability
Yandex Browser (< 24.7.1.380)
Evidence
Unknown
Severity
High
Action
Elevated
Sources
3 public sources
Freshness
Revision 1Nov 9, 13:35 UTC
Detection
1 rule
Vulnerabilities
1 CVE
Source quality
B2Likely

Yandex Browser for Desktop versions prior to 24.7.1.380 are vulnerable to DLL hijacking. The application uses an untrusted search path that allows a local attacker to place a malicious DLL within the installation directory. When the browser starts, it loads the malicious library, resulting in local code execution. A functional proof-of-concept has been published, utilizing a ProxyDll-based approach.

Impact

Successful exploitation allows a local attacker to execute arbitrary code with the permissions of the user running the Yandex Browser process.

Recommendation

  • Upgrade Yandex Browser to version 24.7.1.380 or later to remediate the vulnerable search path.
  • Implement monitoring for the creation of new DLL files within the %LOCALAPPDATA%\Yandex\YandexBrowser\Application directory.
  • Audit the application directory for non-standard DLLs or files with suspicious naming patterns.

Immediate actions

Patch Yandex Browser to 24.7.1.380 or later

IT Operations 48h

Threat Hunt

Identify new file creation events in Yandex application directory

T1574.001 high medium confidence hunt now

Data: File creation logs (Sysmon Event ID 11)

Mitigations

Upgrade to version 24.7.1.380

immediate IT Operations

CVE-2024-6473

Detection coverage 1

Detect DLL Load from Yandex Browser Application Directory

medium

Detects potentially malicious DLL loading from the Yandex Browser application directory, which may indicate exploitation of CVE-2024-6473.

sigma tactics: defense-evasion, persistence, privilege-escalation techniques: T1574.001 sources: image_load, windows

Detection queries are available on the platform. Get full rules →