{"id":163642,"date":"2024-05-24T13:13:46","date_gmt":"2024-05-24T13:13:46","guid":{"rendered":"https:\/\/securityaffairs.com\/?p=163642"},"modified":"2024-05-24T13:13:47","modified_gmt":"2024-05-24T13:13:47","slug":"8th-chrome-zero-day-2024-html","status":"publish","type":"post","link":"https:\/\/securityaffairs.com\/163642\/hacking\/8th-chrome-zero-day-2024-html.html","title":{"rendered":"Google fixes eighth actively exploited Chrome zero-day this year, the third in a month"},"content":{"rendered":"
<\/div>\n

Google rolled out a new emergency security update to fix another actively exploited zero-day vulnerability in the Chrome browser.<\/h2>\n\n\n\n

Google has released a new emergency security update to address a new vulnerability, tracked as CVE-2024-5274, in the Chrome browser, it is the eighth zero-day exploited in attacks disclosed this year.<\/p>\n\n\n\n

The vulnerability is a high-severity ‘type confusion’ in the V8 JavaScript engine, the Google researcher Cl\u00e9ment Lecigne and Brendon Tiszka discovered it. The company confirmed that the flaw is exploited in attacks in the wild.<\/gwmw><\/p>\n\n\n\n

“Type Confusion in V8. Reported by Cl\u00e9ment Lecigne of Google’s Threat Analysis Group and Brendon Tiszka of Chrome Security on 2024-05-20<\/em>” reads the security advisory<\/a>. “Google is aware that an exploit for CVE-2024-5274 exists in the wild.” <\/em><\/p>\n\n\n\n

A “type confusion” vulnerability occurs when a program incorrectly handles variables of one type as if they were another type. This can happen due to flaws in type checking, casting, or other operations involving variable types, leading to unpredictable behavior and potential security risks.<\/p>\n\n\n\n

As usual, Google did not publish details about the attacks exploiting the vulnerability.<\/gwmw><\/p>\n\n\n\n

Access to bug details and links may be kept restricted until a majority of users are updated with a fix. We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven\u2019t yet fixed.<\/em>” continues the advisory.<\/p>\n\n\n\n

Google addressed the issue with the release of version 125.0.6422.112\/.113 for Windows and Mac, while Linux users will get the update on version 125.0.6422.112 in the coming weeks.<\/p>\n\n\n\n

Below is the list of actively exploited zero-day vulnerabilities in the Chrome browser that have been fixed this year:<\/gwmw><\/p>\n\n\n\n