Overview of the Security Flaw

Google has released critical security updates to fix a serious vulnerability in its Chrome browser. This flaw, which has been actively exploited, affects the V8 JavaScript and WebAssembly engine. The vulnerability, identified as CVE-2024-7971, is a type misunderstanding issue that has been classified as high-severity.

You might be interested in: Google Pixel Devices Shipped with Security Flaw

Details of the Vulnerability

The bug, described as a “type confusion” in the V8 engine, affects Chrome versions prior to 128.0.6613.84. This flaw allowed attackers to remotely cause heap corruption using specially crafted HTML pages. The National Vulnerability Database (NVD) has documented this issue, emphasizing its potential for serious harm.

The vulnerability was reported by the Microsoft Threat Intelligence Center (MSTIC) and the Microsoft Security Response Center (MSRC) on August 19, 2024. However, specific details about the attacks or the identities of those responsible have not been disclosed, likely to ensure that most users can apply the fix before more information is made public.

Google’s Response

Google confirmed the existence of an active exploit for CVE-2024-7971 but provided limited information to protect users. Notably, this is the third type confusion flaw in V8 that Google has addressed in 2024, following CVE-2024-4947 and CVE-2024-5274.

So far in 2024, Google has resolved nine zero-day vulnerabilities in Chrome, including several demonstrated at the Pwn2Own 2024 conference:

• CVE-2024-0519 – Out-of-bounds memory access in V8
• CVE-2024-2886 – Use-after-free in WebCodecs (demonstrated at Pwn2Own 2024)
• CVE-2024-2887 – Type confusion in WebAssembly (demonstrated at Pwn2Own 2024)
• CVE-2024-3159 – Out-of-bounds memory access in V8 (demonstrated at Pwn2Own 2024)
• CVE-2024-4671 – Use-after-free in Visuals
• CVE-2024-4761 – Out-of-bounds write in V8
• CVE-2024-4947 – Type confusion in V8
• CVE-2024-5274 – Type confusion in V8

What You Should Do

To stay safe, users should update their Chrome browsers to version 128.0.6613.84/.85 on Windows and macOS, and version 128.0.6613.84 on Linux. Additionally, users of Chromium-based browsers like Microsoft Edge, Brave, Opera, and Vivaldi should apply the latest patches as soon as they become available.

Upgrading to these versions is strongly advised to avoid potential risks associated with this and other vulnerabilities.