Chrome Zero-Day Vulnerability (CVE-2024-7965) Actively Exploited in the Wild

Google has addressed a critical zero-day vulnerability in its Chrome browser, identified as CVE-2024-7965. This high-severity flaw, which affects versions of Chrome prior to 128.0.6613.84, has been actively exploited in the wild, prompting users to update their browsers immediately.

CVE-2024-7965 is a vulnerability in the V8 JavaScript engine used by Chrome. It is characterized by an inappropriate implementation that allows remote attackers to exploit heap corruption through specially crafted HTML pages.

This flaw poses a significant risk, with a CVSS score of 8.8, indicating potential high impacts on the confidentiality and integrity of affected systems.

The vulnerability was reported by a security researcher known as “TheDog” on July 30, 2024, and has since been patched in the latest Chrome release, version 128.0.6613.84 for Linux and 128.0.6613.84/.85 for Windows and Mac.

Google has acknowledged the active exploitation of this vulnerability and emphasizes the urgency of users updating their browsers to mitigate potential threats.

This update follows a blog post in which the company previously stated that it had addressed a different high-severity zero-day vulnerability CVE-2024-7971 resulting from a V8-type confusion weakness.

Exploiting CVE-2024-7965 requires user interaction, such as visiting a compromised webpage, which could lead to unauthorized access or the execution of malicious code. Organizations and individual users are advised to prioritize the update to safeguard against potential data breaches and the loss of sensitive information.

This vulnerability is part of a series of security issues addressed in the latest Chrome update, which includes 38 security fixes. Several high-severity vulnerabilities were reported by external researchers, highlighting the ongoing efforts to secure the browser against emerging threats.

Google’s swift response to patch this zero-day vulnerability underscores the importance of maintaining up-to-date software to protect against cyber threats.

Users are encouraged to enable automatic updates or manually check for updates by navigating to the Chrome menu, selecting “Help,” and then “About Google Chrome” to ensure they are running the latest version.

Chrome Zero-days patched in 2024:

1. CVE-2024-0519: This vulnerability is an out-of-bounds memory access issue in the V8 JavaScript engine used by Google Chrome. It allows attackers to potentially execute arbitrary code by exploiting this flaw. This vulnerability has been addressed by updating to a newer version of Chrome.
2. CVE-2024-2887: This is a type confusion vulnerability in the WebAssembly component of Google Chrome. Type confusion can lead to out-of-bounds memory access, which may result in arbitrary code execution. This vulnerability was demonstrated at Pwn2Own 2024 and has been patched in Chrome updates.
3. CVE-2024-2886: This vulnerability involves a use-after-free condition in the WebCodecs component of Google Chrome. Use-after-free vulnerabilities can lead to arbitrary code execution if exploited. This issue was also demonstrated at Pwn2Own 2024 and has been resolved in subsequent Chrome updates.
4. CVE-2024-3159: Another out-of-bounds memory access vulnerability in the V8 JavaScript engine of Google Chrome. Like other out-of-bounds vulnerabilities, it can be exploited to execute arbitrary code. It was demonstrated at Pwn2Own 2024 and has been fixed in newer Chrome versions.
5. CVE-2024-4671: This is a use-after-free vulnerability in the Visuals component of Google Chrome. Exploiting such vulnerabilities can lead to arbitrary code execution. This vulnerability has been patched in recent Chrome updates.
6. CVE-2024-4947: A type confusion vulnerability in the V8 JavaScript and WebAssembly engine of Google Chrome. This vulnerability has been actively exploited in the wild, prompting urgent updates to Chrome to mitigate the risk.
7. CVE-2024-5274: This vulnerability is a type confusion bug in the V8 JavaScript and WebAssembly engine of Google Chrome. It allows for out-of-bounds memory access, potentially leading to arbitrary code execution. Google has acknowledged active exploitation of this vulnerability and has issued patches.
8. CVE-2024-7971: This vulnerability involves a type of confusion issue within the V8 JavaScript engine, which can be exploited to execute arbitrary code.

Are You From SOC/DFIR Teams? - Try Advanced Malware and Phishing Analysis With ANY.RUN - 14 day free trial