CVE-2024-4761

CVE-2024-4761 is an out-of-bounds write (CWE-787) in the V8 JavaScript engine used by Google Chrome and Chromium. A remote attacker triggers the flaw by persuading a user to load a crafted HTML page, causing V8 to write beyond allocated memory bounds. Successful exploitation yields a high-impact memory corruption condition that can compromise confidentiality, integrity, and availability, potentially enabling arbitrary code execution within the browser process. All Google Chrome releases prior to 124.0.6367.207 are affected, as are Chromium-based distributions such as Fedora's Chromium package. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on 2024-05-16, confirming it is being exploited in the wild, and Google patched it in Chrome 124.0.6367.207.

What to do: Update Google Chrome to 124.0.6367.207 or later on all platforms and verify the running version at chrome://settings/help; Fedora administrators should install the patched chromium package from the Fedora repositories as soon as available. Because the flaw is confirmed exploited in the wild and listed in CISA KEV, treat patching as urgent, prioritizing workstations and servers with browsers used to access untrusted web content. As an interim mitigation, restrict high-risk users' web browsing or isolate browsers until updates are applied.