At present, Google launched a brand new Chrome emergency safety replace to patch a zero-day vulnerability tagged as exploited in assaults.
“Google is conscious that an exploit for CVE-2024-7971 exists within the wild,” the corporate mentioned in an advisory printed on Wednesday.
This high-severity zero-day vulnerability is brought on by a sort confusion weak spot in Chrome’s V8 JavaScript engine. Safety researchers with the Microsoft Risk Intelligence Middle (MSTIC) and Microsoft Safety Response Middle (MSRC) reported it on Monday.
Though such safety flaws can generally allow attackers to set off browser crashes after knowledge allotted into reminiscence is interpreted as a special sort, they will additionally exploit them for arbitrary code execution on focused gadgets working unpatched browsers.
Google has mounted the zero-day with the discharge of 128.0.6613.84/.85 for Home windows/macOS and 128.0.6613.84 (Linux), variations that may roll out to all customers within the Secure Desktop channel over the approaching weeks.
Whereas Chrome updates robotically when safety patches can be found, customers also can velocity up the method by going to the Chrome menu > Assist > About Google Chrome, letting the replace end, and clicking the ‘Relaunch’ button to put in it.
At present’s replace was instantly out there when BleepingComputer appeared for brand spanking new updates right this moment.
Regardless that Google confirmed the CVE-2024-7971 vulnerability was utilized in assaults, the corporate has but to share further data relating to in-the-wild exploitation.
“Entry to bug particulars and hyperlinks could also be stored restricted till a majority of customers are up to date with a repair,” Google mentioned.
“We may even retain restrictions if the bug exists in a 3rd celebration library that different tasks equally rely upon, however have not but mounted.”
CVE-2024-7971 is the ninth Chrome zero-day patched by Google in 2024, both exploited within the wild or on the Pwn2Own hacking contest:
- CVE-2024-0519: A high-severity out-of-bounds reminiscence entry weak spot throughout the Chrome V8 JavaScript engine, permitting distant attackers to take advantage of heap corruption through a specifically crafted HTML web page, resulting in unauthorized entry to delicate data.
- CVE-2024-2887: A high-severity sort confusion flaw within the WebAssembly (Wasm) normal. It might result in distant code execution (RCE) exploits leveraging a crafted HTML web page.
- CVE-2024-2886: A use-after-free vulnerability within the WebCodecs API utilized by net functions to encode and decode audio and video. Distant attackers exploited it to carry out arbitrary reads and writes through crafted HTML pages, resulting in distant code execution.
- CVE-2024-3159: A high-severity vulnerability brought on by an out-of-bounds learn within the Chrome V8 JavaScript engine. Distant attackers exploited this flaw utilizing specifically crafted HTML pages to entry knowledge past the allotted reminiscence buffer, leading to heap corruption that could possibly be leveraged to extract delicate data.
- CVE-2024-4671: A high-severity use-after-free flaw within the Visuals element that handles the rendering and displaying of content material within the browser.
- CVE-2024-4761: An out-of-bounds write drawback in Chrome’s V8 JavaScript engine, which is liable for executing JS code within the software.
- CVE-2024-4947: Kind confusion weak spot within the Chrome V8 JavaScript engine enabling arbitrary code execution on the goal machine.
- CVE-2024-5274: A kind confusion Chrome’s V8 JavaScript engine that may result in crashes, knowledge corruption, or arbitrary code execution