<\/div>\n

Google released emergency security updates to fix the ninth actively exploited Chrome zero-day vulnerability this year.<\/h2>\n\n\n\n

\u200b\u200bGoogle released an emergency security update to address a Chrome zero-day vulnerability, tracked as CVE-2024-7971, that is actively exploited.<\/p>\n\n\n\n

The vulnerability is a type confusion issue that resides in Chrome’s V8 JavaScript engine. <\/p>\n\n\n\n

“Google is aware that an exploit for CVE-2024-7971 exists in the wild.” reads<\/a> the advisory published by the company that did not share details about the attacks exploiting the issue. “Access to bug details and links may be kept restricted until a majority of users are updated with a fix. We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven\u2019t yet fixed.”.<\/em><\/gwmw><\/p>\n\n\n\n

“We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven’t yet fixed.”<\/p>\n\n\n\n

Security researchers with the Microsoft Threat Intelligence Center (MSTIC) and Microsoft Security Response Center (MSRC) reported the flaw to Google.<\/p>\n\n\n\n

Google addressed the vulnerability with the release of 128.0.6613.84\/.85 for Windows\/macOS systems and version 128.0.6613.84 Linux. The company will release versions for all users in the Stable Desktop channel over the coming weeks.<\/p>\n\n\n\n

\u200bBelow is the list of actively exploited zero-day vulnerabilities in the Chrome browser that have been fixed this year:<\/p>\n\n\n\n

\n
• CVE-2024-0519<\/a><\/strong>: an out of bounds memory access in the Chrome JavaScript engine. (January 2024)<\/gwmw><\/li>\n\n\n\n
• CVE-2024-2887<\/a><\/strong>:  a type of confusion issue that resides in WebAssembly. Manfred Paul demonstrated<\/a> the vulnerability during the Pwn2Own 2024. (March 2024)<\/li>\n\n\n\n
• CVE-2024-2886<\/a><\/strong>: a use after free issue that resides in the WebCodecs. The flaw was demonstrated by Seunghyun Lee (@0x10n<\/a>) of KAIST Hacking Lab during the Pwn2Own 2024. (March 2024)<\/li>\n\n\n\n
• CVE-2024-3159<\/a><\/strong>: an out-of-bounds memory access in V8 JavaScript engine. The flaw was demonstrated by Edouard Bochin (@le_douds) and Tao Yan (@Ga1ois) of Palo Alto Networks during the Pwn2Own 2024 on March 22, 2024. (March 2024)<\/li>\n\n\n\n
• CVE-2024-4671<\/strong><\/a>: a use-after-free issue that resides in the Visuals component (May 2024). <\/li>\n\n\n\n
• CVE-2024-4761<\/a><\/strong>: an out-of-bounds write issue that resides in the V8 JavaScript engine (May 2024).<\/li>\n\n\n\n
• CVE-2024-4947<\/strong><\/a>: a type confusion that resides in V8 JavaScript engine (May 2024). <\/li>\n\n\n\n
• CVE-2024-5274<\/a><\/strong>: a type confusion Chrome’s V8 JavaScript engine that can lead to crashes, data corruption, or arbitrary code execution (May 2024).<\/li>\n<\/ul>\n\n\n\n

  <\/gwmw><\/gwmw><\/gwmw><\/p>\n\n\n\n

  Follow me on Twitter: @securityaffairs<\/strong><\/a> and Facebook<\/strong><\/a> and Mastodon<\/strong><\/a><\/p>\n\n\n\n

  Pierluigi Paganini<\/strong><\/a><\/p>\n\n\n\n

  (<\/strong>SecurityAffairs<\/strong><\/a> \u2013<\/strong> hacking, Google)<\/strong><\/p>\n","protected":false},"excerpt":{"rendered":"

  Google released emergency security updates to fix the ninth actively exploited Chrome zero-day vulnerability this year. \u200b\u200bGoogle released an emergency security update to address a Chrome zero-day vulnerability, tracked as CVE-2024-7971, that is actively exploited. The vulnerability is a type confusion issue that resides in Chrome’s V8 JavaScript engine. “Google is aware that an exploit for CVE-2024-7971 […]<\/p>\n","protected":false},"author":1,"featured_media":45647,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[3323,5,55],"tags":[1324,2037,4112,9506,10918,687,841,1533],"class_list":["post-167403","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-breaking-news","category-hacking","category-security","tag-android-firefox-zero-day","tag-chrome","tag-hacking","tag-information-security-news","tag-it-information-security","tag-pierluigi-paganini","tag-security-affairs","tag-security-news"],"yoast_head":"\n