At the moment, Google launched a brand new Chrome emergency safety replace to patch a zero-day vulnerability tagged as exploited assaults.
“Google is aware that an exploit for CVE-2024-7971 exists in the wild,” the corporate mentioned in an advisory printed on Wednesday.
This high-severity zero-day vulnerability is brought on by a kind confusion weak spot in Chrome’s V8 JavaScript engine. Safety researchers with the Microsoft Risk Intelligence Middle (MSTIC) and Microsoft Safety Response Middle (MSRC) reported it on Monday.
Though such safety flaws can generally allow attackers to set off browser crashes after knowledge allotted into reminiscence is interpreted as a distinct kind, they’ll additionally exploit them for arbitrary code execution on focused gadgets working unpatched browsers.
Google has fastened the zero-day with the discharge of 128.0.6613.84/.85 for Home windows/macOS and 128.0.6613.84 (Linux), variations that may roll out to all customers within the Steady Desktop channel over the approaching weeks.
Whereas Chrome updates robotically when safety patches can be found, customers may also velocity up the method by going to the Chrome menu > Assist > About Google Chrome, letting the replace end, and clicking the ‘Relaunch’ button to put in it.
At the moment’s replace was instantly out there when BleepingComputer appeared for brand new updates in the present day.
Though Google confirmed the CVE-2024-7971 vulnerability was utilized in assaults, the corporate has but to share extra data relating to in-the-wild exploitation.
“Access to bug details and links may be kept restricted until a majority of users are updated with a fix,” Google mentioned.
“We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven’t yet fixed.”
CVE-2024-7971 is the ninth actively exploited Chrome zero-day patched by Google in 2024, with the entire record of zero-days fastened this yr together with:
- CVE-2024-0519: A high-severity out-of-bounds reminiscence entry weak spot throughout the Chrome V8 JavaScript engine, permitting distant attackers to use heap corruption by way of a specifically crafted HTML web page, resulting in unauthorized entry to delicate data.
- CVE-2024-2887: A high-severity kind confusion flaw within the WebAssembly (Wasm) normal. It might result in distant code execution (RCE) exploits leveraging a crafted HTML web page.
- CVE-2024-2886: A use-after-free vulnerability within the WebCodecs API utilized by net purposes to encode and decode audio and video. Distant attackers exploited it to carry out arbitrary reads and writes by way of crafted HTML pages, resulting in distant code execution.
- CVE-2024-3159: A high-severity vulnerability brought on by an out-of-bounds learn within the Chrome V8 JavaScript engine. Distant attackers exploited this flaw utilizing specifically crafted HTML pages to entry knowledge past the allotted reminiscence buffer, leading to heap corruption that might be leveraged to extract delicate data.
- CVE-2024-4671: A high-severity use-after-free flaw within the Visuals element that handles the rendering and displaying of content material within the browser.
- CVE-2024-4761: An out-of-bounds write drawback in Chrome’s V8 JavaScript engine, which is accountable for executing JS code within the software.
- CVE-2024-4947: Kind confusion weak spot within the Chrome V8 JavaScript engine enabling arbitrary code execution on the goal machine.
- CVE-2024-5274: A sort confusion Chrome’s V8 JavaScript engine that may result in crashes, knowledge corruption, or arbitrary code execution
