Google Chrome 126 update addresses multiple high
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2024-6100 | Type Confusion in V8 in Google Chrome prior to 126.0.6478.114 allowed a remote attacker to execute arbitrary code via a crafted HTML page. Type Confusion in V8 in Google Chrome prior to 126.0.6478.114 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High) NVD description · AI analysis pending | 8.8 | 1% |
| — |
Full article233 words · extracted from securityaffairs.com · click to collapse
Google released Chrome 126 update that addresses a high-severity vulnerability demonstrated at the TyphoonPWN 2024 hacking competition.
Google has issued a Chrome 126 security update, addressing six vulnerabilities, including a flaw, tracked as CVE-2024-6100 which was demonstrated during the SSD Secure Disclosure’s TyphoonPWN 2024. TyphoonPWN is a live hacking competition held annually at TyphoonCon, an Offensive Security Conference in Seoul, South Korea.
The vulnerability is a high-severity type confusion issue in the V8 script engine that was reported by Seunghyun Lee (@0x10n) participating in SSD Secure Disclosure’s TyphoonPWN 2024 on 2024-06-04
Lee received a $20,000 bug bounty reward for reporting the issue.
Google also addressed the following issues:
- A high-severity inappropriate implementation issue, tracked as CVE-2024-6101, in WebAssembly. @ginggilBesel reported the flaw on 2024-05-31 and Google awarded him $7000.
- A high-severity out-of-bounds memory access in Dawn, tracked as CVE-2024-6102. wgslfuzz reported the flaw on 2024-05-07.
- A high-severity use after free in Dawn tracked as CVE-2024-6103: wgslfuzz reported the flaw on 2024-06-04
Google hasn’t shared technical details on the vulnerabilities, the good news is that the company is not aware of attacks in the wild exploiting the flaws addressed by the Chrome 126 security update.
Chrome 126 security update is now rolling out to users as version 126.0.6478.114 for Linux and as versions 126.0.6478.114/115 for Windows and macOS.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, Google)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/164688/security/google-chrome-126-update.html