<\/div>\n

Google released emergency security updates to fix the tenth actively exploited Chrome zero-day vulnerability this year.<\/h2>\n\n\n\n

Google released a security update to address a new Chrome zero-day vulnerability, tracked as\u00a0CVE-2024-7965<\/a> (CVSS score 8.8), that is actively exploited.<\/gwmw><\/p>\n\n\n\n

The vulnerability is an Inappropriate implementation\u00a0issue that resides in Chrome’s V8 JavaScript engine.<\/p>\n\n\n\n

“Google is aware that exploits for CVE-2024-7971 and CVE-2024-7965 exist in the wild.” reads<\/a>\u00a0the advisory published by the company that did not share details about the attacks exploiting the issue. “Access to bug details and links may be kept restricted until a majority of users are updated with a fix. We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven\u2019t yet fixed.”.<\/em><\/p>\n\n\n\n

“We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven’t yet fixed.”<\/gwmw><\/p>\n\n\n\n

The security researcher TheDog reported the flaw on 2024-07-30.<\/p>\n\n\n\n

Google addressed the vulnerability with the release of 128.0.6613.84\/.85 for Windows\/macOS and 128.0.6613.84 (Linux). The company will release versions for all users in the Stable Desktop channel over the coming weeks.<\/p>\n\n\n\n

\u200bBelow is the list of actively exploited zero-day vulnerabilities in the Chrome browser that have been fixed this year:<\/p>\n\n\n\n

\n
• CVE-2024-5274<\/a><\/strong>: a type confusion Chrome’s V8 JavaScript engine that can lead to crashes, data corruption, or arbitrary code execution (May 2024).<\/gwmw><\/gwmw><\/li>\n\n\n\n
• CVE-2024-0519<\/a><\/strong>: an out of bounds memory access in the Chrome JavaScript engine. (January 2024)<\/gwmw><\/li>\n\n\n\n
• CVE-2024-2887<\/a><\/strong>:  a type of confusion issue that resides in WebAssembly. Manfred Paul demonstrated<\/a> the vulnerability during the Pwn2Own 2024. (March 2024)<\/li>\n\n\n\n
• CVE-2024-2886<\/a><\/strong>: a use after free issue that resides in the WebCodecs. The flaw was demonstrated by Seunghyun Lee (@0x10n<\/a>) of KAIST Hacking Lab during the Pwn2Own 2024. (March 2024)<\/li>\n\n\n\n
• CVE-2024-3159<\/a><\/strong>: an out-of-bounds memory access in V8 JavaScript\u00a0engine. The flaw was demonstrated by Edouard Bochin (@le_douds) and Tao Yan (@Ga1ois) of Palo Alto Networks during the Pwn2Own 2024 on March 22, 2024. (March 2024)<\/gwmw><\/li>\n\n\n\n
• CVE-2024-4671<\/strong><\/a>: a use-after-free issue that resides in the Visuals component (May 2024).\u00a0<\/li>\n\n\n\n
• CVE-2024-4761<\/a><\/strong>: an out-of-bounds write issue that resides in the V8 JavaScript engine (May 2024).<\/li>\n\n\n\n
• CVE-2024-4947<\/strong><\/a>: a type confusion that resides in V8 JavaScript engine (May 2024).\u00a0<\/gwmw><\/li>\n\n\n\n
• CVE-2024-7971<\/a><\/strong>: a type confusion that resides in V8 JavaScript engine (August 2024).\u00a0<\/gwmw><\/gwmw><\/gwmw><\/li>\n<\/ul>\n\n\n\n

  Follow me on Twitter: @securityaffairs<\/strong><\/a> and Facebook<\/strong><\/a> and Mastodon<\/strong><\/a><\/p>\n\n\n\n

  Pierluigi Paganini<\/strong><\/a><\/p>\n\n\n\n

  (<\/strong>SecurityAffairs<\/strong><\/a>\u00a0\u2013<\/strong>\u00a0hacking, Google)<\/strong><\/gwmw><\/p>\n","protected":false},"excerpt":{"rendered":"

  Google released emergency security updates to fix the tenth actively exploited Chrome zero-day vulnerability this year. Google released a security update to address a new Chrome zero-day vulnerability, tracked as\u00a0CVE-2024-7965 (CVSS score 8.8), that is actively exploited. The vulnerability is an Inappropriate implementation\u00a0issue that resides in Chrome’s V8 JavaScript engine. “Google is aware that exploits […]<\/p>\n","protected":false},"author":1,"featured_media":45647,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[3323,5,55],"tags":[2037,4112,9508,9506,10918,687,1533],"class_list":["post-167631","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-breaking-news","category-hacking","category-security","tag-chrome","tag-hacking","tag-hacking-news","tag-information-security-news","tag-it-information-security","tag-pierluigi-paganini","tag-security-news"],"yoast_head":"\n