Google fixed another Chrome zero
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2024-0519 | Out-of-Bounds Memory Access in Google Chrome/Chromium V8 (Actively Exploited) Google Chrome's V8 JavaScript engine, in versions prior to 120.0.6099.224, contains an out-of-bounds memory access flaw (CWE-787 out-of-bounds write / CWE-125 out-of-bounds read) that is triggered when a user visits a specially crafted HTML page. A remote attacker who lures a victim to such a page can potentially corrupt the heap and execute code in the context of the browser. Successful exploitation could lead to exposure of sensitive information, data tampering, or denial of service (CVSS 3.1: 8.8 High; user interaction is required). Anyone running a vulnerable Chrome/Chromium build is affected, including downstream products that embed V8, such as Fedora's Chromium/Chrome packages and Couchbase Server. The flaw is being actively exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2024-01-17, and news coverage describes it as one of Google's actively exploited Chrome zero-days patched in January 2024. Do: Update Google Chrome to 120.0.6099.224 or later (and restart the browser so the new version is fully loaded); verify fleet versions via Chrome's version reporting if managing enterprise deployments. Fedora users should install the updated chromium/chrome packages via the distribution's update channel, and Couchbase Server operators should apply the vendor's guidance. Because the flaw is on CISA's KEV catalog, federal and other regulated environments are required to apply vendor mitigations promptly; the only effective mitigation is patching, as no public PoC or alternate workaround is documented. | 8.8 | 4% | KEV |
| massbillions of users (Chrome holds roughly 65% of desktop browser share with over 3 billion users, and any browser prior to 120.0.6099.224 was vulnerable) | |
| CVE-2024-2887 +1 in the same advisory: …2886 | Type Confusion in WebAssembly in Google Chrome prior to 123.0.6312.86 allowed a remote attacker to execute arbitrary code via a crafted HTML page. Type Confusion in WebAssembly in Google Chrome prior to 123.0.6312.86 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High) NVD description · AI analysis pending | 7.7 group max | 18% | PoC ×2 |
| — | |
| CVE-2024-3156 | Inappropriate implementation in V8 in Google Chrome prior to 123.0.6312.105 allowed a remote attacker to potentially perform out of bounds memory access via a c Inappropriate implementation in V8 in Google Chrome prior to 123.0.6312.105 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High) NVD description · AI analysis pending | 8.8 | 13% |
| — |
Full article392 words · extracted from securityaffairs.com · click to collapse
Google fixed another Chrome zero-day vulnerability exploited during the Pwn2Own hacking competition in March.
Google has addressed another zero-day vulnerability in the Chrome browser, tracked as CVE-2024-3159, that was exploited during the Pwn2Own hacking competition in March, 2024.
The vulnerability CVE-2024-3159 is an out of bounds memory access in V8 JavaScript engine. The flaw was demonstrated by Edouard Bochin (@le_douds) and Tao Yan (@Ga1ois) of Palo Alto Networks during the Pwn2Own 2024 on March 22, 2024. The duo earned $42,500 and 9 Master of Pwn points for demonstrating their exploit against Google Chrome and Microsoft Edge.
A remote attacker can exploit this issue by tricking the victim into visiting a specially crafted HTML page to gain access to data beyond the memory buffer triggering heap corruption. The exploitation can lead to the disclosure of sensitive information or a crash.
Palo Alto Networks security researchers Edouard Bochin and Tao Yan demoed the zero-day on the second day of Pwn2Own Vancouver 2024 to defeat V8 hardening.
“The Stable channel has been updated to 123.0.6312.105/.106/.107 for Windows and Mac and 123.0.6312.105 to Linux which will roll out over the coming days/weeks.” reads the Release updates from the Chrome team.
The IT giant also addressed the following issues:
- [$7000][329130358] High CVE-2024-3156: Inappropriate implementation in V8. Reported by Zhenghang Xiao (@Kipreyyy) on 2024-03-12
- [$3000][329965696] High CVE-2024-3158: Use after free in Bookmarks. Reported by undoingfish on 2024-03-17
At the end of March, Google addressed several vulnerabilities in the Chrome web browser this week, including two zero-day vulnerabilities, tracked as CVE-2024-2886 and CVE-2024-2887, which were demonstrated during the Pwn2Own Vancouver 2024 hacking competition.
The high-severity vulnerability CVE-2024-2886 is a use after free issue that resides in the WebCodecs. The flaw was demonstrated by Seunghyun Lee (@0x10n) of KAIST Hacking Lab during the Pwn2Own 2024.
The high-serverity vulnerability CVE-2024-2887 is a type confusion issue that resides in WebAssembly. Manfred Paul demonstrated the vulnerability during the Pwn2Own 2024.
In January, Google addressed the first Chrome zero-day vulnerability of the year that is actively being exploited in the wild.
The high-serverity vulnerability, tracked as CVE-2024-0519, is an out of bounds memory access in the Chrome JavaScript engine. The flaw was reported by Anonymous on January 11, 2024.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, Google)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/161445/hacking/google-chrome-zero-day-pwn2own.html