New Chrome Zero-Day
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2024-7971 | Type Confusion in Google Chromium V8 Enables Heap Corruption via Malicious Pages Google Chromium's V8 JavaScript engine contains a type confusion flaw (CWE-843) that lets a remote attacker trigger heap corruption through a specially crafted HTML page. The attack is triggered simply by a user loading an attacker-controlled web page, with no other interaction required. Successful exploitation of heap corruption in a browser JavaScript engine typically gives the attacker code execution within the browser process, a common first step toward broader system compromise. All users of Chromium-based browsers are affected, including Google Chrome, Microsoft Edge, Opera, and any other product embedding Chromium V8. CISA added the vulnerability to the Known Exploited Vulnerabilities catalog on 2024-08-26, confirming active in-the-wild exploitation, and EPSS assigns a 20.7% probability of exploitation within 30 days (97th percentile). Do: Update all Chromium-based browsers (Chrome, Edge, Opera, Brave) to the vendors' patched releases immediately and verify the installed version via chrome://version or edge://version. Per CISA's KEV required action, apply vendor mitigations or discontinue use if patches are unavailable; until patching completes, treat web browsing on high-value systems with caution and watch for vendors to publish the specific fixed version numbers. | 9.6 | 21% | KEV PoC |
| massbillions of users/installations (Chrome alone is estimated at ~3 billion+ users, plus Edge, Opera, Brave and other Chromium browsers) |
Full article443 words · extracted from schneier.com · click to collapse
Comments
Clive Robinson • September 10, 2024 9:56 AM
How many times has North Korea pinched the contents of crypto coin wallets?
If it was turned into an Olympic Sport they would be “Front runners” based on what has been claimed in the past…
But Microsoft say,
“CVE-2024-7971 is a type confusion vulnerability in the V8 JavaScript and WebAssembly engine …”
An RCE via JavaScript/WebAssembly,
“Who’d have thunk?”
Well readers here should know by now that JavaScript, WebAssembly, and a big chunk of HTML5 really should not be used for various “in-security” reasons. Not least because they all allow a system to be used in ways most users would not like at all.
Several people here, have pointed this out for years if not decades in the case of JavaScript…
Lazaro • September 11, 2024 1:12 PM
I agree with Clive about Javascript. If one had it disabled, one wouldn’t have been affected by this bug. Unfortunately, one would also be unable to read about it in issues.chromium.org; or, at least, I’m assuming that’s why the page has nothing but a “Sign in” button (and the HTML has a lot of obfuscated Javascript).
The Microsoft link is telling me “We are currently experiencing high demand. Please wait and try again later.” Perhaps they should try hosting it on some reliable cloud service… anyway, here’s an archive.org link for that post. It links to a page about a Windows kernel sandbox-escape exploit, which says “You need to enable JavaScript to run this app” (wait, what app? I’m just trying to view a page).
Sandboxing is kind of a weak point in modern operating systems. As far as I know, most implementations have sandboxed and non-sandboxed programs using the same kernel entry points, each of which is expected to properly enforce the sandbox if necessary. Microsoft could probably fix this more readily than the Linux developers, who need to deal with internal politics and distributors. Swap the interrupt vector table for sandboxed processes, or even put the whole OS under a hypervisor and run them that way (they’ve got Hyper-V, after all, plus a well-funded research division who might enjoy making Windows run under something like seL4).
Clive Robinson • September 14, 2024 1:10 PM
@ Bruce,
I have not done private EMail for years, so don’t have anything set up.
Over the W’kend I’m looking into a way to get a message to you, that does not involve any of the idiocy and privacy invasion required by many methods these days.
Subscribe to comments on this entry
Sidebar photo of Bruce Schneier by Joe MacInnis.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.schneier.com/blog/archives/2024/09/new-chrome-zero-day.html