As we speak, Google launched a brand new Chrome emergency safety replace to patch a zero-day vulnerability tagged as exploited in assaults.
“Google is aware that an exploit for CVE-2024-7971 exists in the wild,” the corporate mentioned in an advisory printed on Wednesday.
This high-severity zero-day vulnerability is brought on by a sort confusion weak spot in Chrome’s V8 JavaScript engine. Safety researchers with the Microsoft Risk Intelligence Middle (MSTIC) and Microsoft Safety Response Middle (MSRC) reported it on Monday.
Though such safety flaws can generally allow attackers to set off browser crashes after knowledge allotted into reminiscence is interpreted as a distinct sort, they’ll additionally exploit them for arbitrary code execution on focused gadgets working unpatched browsers.
Google has fastened the zero-day with the discharge of 128.0.6613.84/.85 for Home windows/macOS and 128.0.6613.84 (Linux), variations that can roll out to all customers within the Steady Desktop channel over the approaching weeks.
Whereas Chrome updates mechanically when safety patches can be found, customers can even velocity up the method by going to the Chrome menu > Assist > About Google Chrome, letting the replace end, and clicking the ‘Relaunch’ button to put in it.
As we speak’s replace was instantly obtainable when BleepingComputer regarded for brand new updates right now.
Although Google confirmed the CVE-2024-7971 vulnerability was utilized in assaults, the corporate has but to share extra data relating to in-the-wild exploitation.
“Access to bug details and links may be kept restricted until a majority of users are updated with a fix,” Google mentioned.
“We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven’t yet fixed.”
CVE-2024-7971 is the ninth Chrome zero-day patched by Google in 2024, both exploited within the wild or on the Pwn2Own hacking contest:
- CVE-2024-0519: A high-severity out-of-bounds reminiscence entry weak spot inside the Chrome V8 JavaScript engine, permitting distant attackers to use heap corruption through a specifically crafted HTML web page, resulting in unauthorized entry to delicate data.
- CVE-2024-2887: A high-severity sort confusion flaw within the WebAssembly (Wasm) normal. It may result in distant code execution (RCE) exploits leveraging a crafted HTML web page.
- CVE-2024-2886: A use-after-free vulnerability within the WebCodecs API utilized by internet purposes to encode and decode audio and video. Distant attackers exploited it to carry out arbitrary reads and writes through crafted HTML pages, resulting in distant code execution.
- CVE-2024-3159: A high-severity vulnerability brought on by an out-of-bounds learn within the Chrome V8 JavaScript engine. Distant attackers exploited this flaw utilizing specifically crafted HTML pages to entry knowledge past the allotted reminiscence buffer, leading to heap corruption that might be leveraged to extract delicate data.
- CVE-2024-4671: A high-severity use-after-free flaw within the Visuals part that handles the rendering and displaying of content material within the browser.
- CVE-2024-4761: An out-of-bounds write downside in Chrome’s V8 JavaScript engine, which is accountable for executing JS code within the software.
- CVE-2024-4947: Sort confusion weak spot within the Chrome V8 JavaScript engine enabling arbitrary code execution on the goal system.
- CVE-2024-5274: A sort confusion Chrome’s V8 JavaScript engine that may result in crashes, knowledge corruption, or arbitrary code execution
