Commercial spyware vendor exploits used by Kremlin

CVE-2021-37973 is a use-after-free (CWE-416) in the Portals feature of Google Chrome prior to 94.0.4606.61. It is triggered via a crafted HTML page, and per the vendor description it allows a remote attacker who has already compromised the renderer process to potentially escape Chrome's sandbox; the CVSS vector confirms network reachability with required user interaction (UI:R). A successful exploit turns a renderer-level compromise into code execution outside the sandbox, with high impact to confidentiality, integrity, and availability (scope change, 9.6 critical). Anyone running Chrome or Chromium builds before 94.0.4606.61 is affected, including the chromium packages shipped by Fedora and Debian. Exploitation is confirmed in the wild: the flaw was added to CISA's KEV catalog on 2021-11-03, Google patched it as one of two actively exploited Chrome zero-days (EPSS 11.6%, 96th percentile), no public PoC is known, and related reporting ties the era's actively exploited Chrome zero-days to mercenary spyware such as Intellexa/Cytrox's Predator.

Do: Upgrade Google Chrome to 94.0.4606.61 or later (confirm the running version at chrome://version) and update the chromium packages on Fedora and Debian to their patched builds. Because the flaw is on the CISA KEV list, applying vendor updates is required for federal and critical-infrastructure environments; enable automatic browser updates and prioritize patching where users browse untrusted web content, since exploitation is typically delivered via crafted pages in a chain.

Apple's WebKit engine, which renders web content for Safari and for essentially all HTML processing on iOS, iPadOS, and macOS, contains a flaw that leads to code execution when processing maliciously crafted web content. It is triggered when a user's browser or embedded web view loads attacker-controlled web content, so simply visiting a hostile page can be enough. Successful exploitation could allow arbitrary code execution within the affected application's context, a common stepping stone to broader device compromise. All users of Apple iOS, iPadOS, macOS, and Safari are potentially affected, as are users of non-Apple products that rely on WebKit for HTML processing. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2023-09-25, indicating confirmed in-the-wild exploitation; no public proof-of-concept is known.

Do: Apply Apple's latest security updates for iOS, iPadOS, macOS, and Safari that patch WebKit, following the vendor instructions referenced by the CISA KEV entry, and treat unpatched WebKit builds as actively exploited. Until systems are patched, restrict exposure to untrusted web content (e.g., limit browsing and in-app web views to trusted sites for high-risk users). Also inventory any non-Apple applications or HTML-processing components in your environment that bundle WebKit and update them as their maintainers ship fixes.

CVE-2024-4671 is a use-after-free (CWE-416) in the Visuals component of Google Chrome and Chromium, fixed in Chrome 124.0.6367.201. It is triggered via a crafted HTML page, but the attacker must already have compromised the browser's renderer process, so this flaw is typically chained with a renderer exploit rather than used standalone. Successful exploitation enables a sandbox escape, letting the attacker break out of Chrome's renderer sandbox and gain broader access to the system beyond the browser tab. All users of Google Chrome versions prior to 124.0.6367.201 are affected, and per CISA's CPE data, Fedora's packaged Chromium builds are also in scope. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2024-05-13, indicating active exploitation in the wild; no public proof-of-concept is known, EPSS estimates an 8.3% chance of exploitation within 30 days (95th percentile), and ransomware association is unknown.

Do: Update Google Chrome to 124.0.6367.201 or later (verify via chrome://settings/help, since Chrome auto-updates may lag), and update Fedora's chromium package to the fixed build; CISA KEV requires federal agencies to apply the vendor fix on the mandated timeline. Because this sandbox escape must be chained with a renderer compromise, defenders should treat any unpatched Chrome deployment as exposed and confirm via EDR logs whether suspicious renderer-process activity occurred; enterprise admins should push the update through managed-browser channels immediately.

CVE-2024-5274 is a type confusion flaw (CWE-843) in the V8 JavaScript engine of Google Chrome prior to 125.0.6422.112. A remote attacker can trigger it by persuading a user to open or interact with a crafted HTML page. Successful exploitation allows the attacker to execute arbitrary code inside the browser's sandbox, and the scope-changed CVSS scoring indicates potential impact beyond the browser process itself. Anyone running an affected Chrome or Chromium build, including Chromium-derived distributions such as Fedora's Chromium package, is exposed. The flaw was added to CISA's KEV on 2024-05-28, a public PoC reference exists, and related news reports describe it as actively exploited in the wild.

Do: Upgrade Google Chrome to 125.0.6422.112 or later and confirm the build via chrome://version; Fedora users and users of Chromium-derived browsers should install the corresponding updated packages from their vendor. Because the flaw is listed in CISA KEV, federal agencies and targeted organizations must apply the vendor fix or discontinue use per the required action, and all users should avoid untrusted web content until patched.