Update Chrome Browser Now: 4th Zero

Google Chrome's V8 JavaScript engine, in versions prior to 120.0.6099.224, contains an out-of-bounds memory access flaw (CWE-787 out-of-bounds write / CWE-125 out-of-bounds read) that is triggered when a user visits a specially crafted HTML page. A remote attacker who lures a victim to such a page can potentially corrupt the heap and execute code in the context of the browser. Successful exploitation could lead to exposure of sensitive information, data tampering, or denial of service (CVSS 3.1: 8.8 High; user interaction is required). Anyone running a vulnerable Chrome/Chromium build is affected, including downstream products that embed V8, such as Fedora's Chromium/Chrome packages and Couchbase Server. The flaw is being actively exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2024-01-17, and news coverage describes it as one of Google's actively exploited Chrome zero-days patched in January 2024.

Do: Update Google Chrome to 120.0.6099.224 or later (and restart the browser so the new version is fully loaded); verify fleet versions via Chrome's version reporting if managing enterprise deployments. Fedora users should install the updated chromium/chrome packages via the distribution's update channel, and Couchbase Server operators should apply the vendor's guidance. Because the flaw is on CISA's KEV catalog, federal and other regulated environments are required to apply vendor mitigations promptly; the only effective mitigation is patching, as no public PoC or alternate workaround is documented.

Type Confusion in WebAssembly in Google Chrome prior to 123.0.6312.86 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

Out of bounds memory access in V8 in Google Chrome prior to 123.0.6312.105 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: High)

CVE-2024-4671 is a use-after-free (CWE-416) in the Visuals component of Google Chrome and Chromium, fixed in Chrome 124.0.6367.201. It is triggered via a crafted HTML page, but the attacker must already have compromised the browser's renderer process, so this flaw is typically chained with a renderer exploit rather than used standalone. Successful exploitation enables a sandbox escape, letting the attacker break out of Chrome's renderer sandbox and gain broader access to the system beyond the browser tab. All users of Google Chrome versions prior to 124.0.6367.201 are affected, and per CISA's CPE data, Fedora's packaged Chromium builds are also in scope. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2024-05-13, indicating active exploitation in the wild; no public proof-of-concept is known, EPSS estimates an 8.3% chance of exploitation within 30 days (95th percentile), and ransomware association is unknown.

Do: Update Google Chrome to 124.0.6367.201 or later (verify via chrome://settings/help, since Chrome auto-updates may lag), and update Fedora's chromium package to the fixed build; CISA KEV requires federal agencies to apply the vendor fix on the mandated timeline. Because this sandbox escape must be chained with a renderer compromise, defenders should treat any unpatched Chrome deployment as exposed and confirm via EDR logs whether suspicious renderer-process activity occurred; enterprise admins should push the update through managed-browser channels immediately.

CVE-2024-4761 is an out-of-bounds write (CWE-787) in the V8 JavaScript engine used by Google Chrome and Chromium. A remote attacker triggers the flaw by persuading a user to load a crafted HTML page, causing V8 to write beyond allocated memory bounds. Successful exploitation yields a high-impact memory corruption condition that can compromise confidentiality, integrity, and availability, potentially enabling arbitrary code execution within the browser process. All Google Chrome releases prior to 124.0.6367.207 are affected, as are Chromium-based distributions such as Fedora's Chromium package. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on 2024-05-16, confirming it is being exploited in the wild, and Google patched it in Chrome 124.0.6367.207.

Do: Update Google Chrome to 124.0.6367.207 or later on all platforms and verify the running version at chrome://settings/help; Fedora administrators should install the patched chromium package from the Fedora repositories as soon as available. Because the flaw is confirmed exploited in the wild and listed in CISA KEV, treat patching as urgent, prioritizing workstations and servers with browsers used to access untrusted web content. As an interim mitigation, restrict high-risk users' web browsing or isolate browsers until updates are applied.

CVE-2024-4947 is a type-confusion flaw (CWE-843) in the V8 JavaScript engine of Google Chrome, rated High by Chromium with a CVSS 3.1 score of 9.6. An attacker triggers it by luring a user to a crafted HTML page, causing V8 to misinterpret object types and enabling execution of arbitrary code inside the Chrome sandbox. Exploitation of the V8 bug alone keeps the attacker sandboxed, but it is a typical first stage of a browser exploit chain and can be paired with sandbox-escape techniques for broader system access. All Google Chrome installations prior to 125.0.6422.60 are affected, as are Fedora's packaged builds of Chrome/Chromium carrying the vulnerable V8 code. The vulnerability was added to CISA's KEV on 2024-05-20, has a public PoC referenced in Google's issue tracker, and public reporting ties its in-the-wild use to the North Korean Lazarus Group, which deployed the FudModule rootkit against infected Chrome users.

Do: Upgrade Google Chrome to 125.0.6422.60 or later on all endpoints, and install the updated chromium packages published for Fedora, prioritizing this patch because the flaw is CISA KEV-listed with a mandatory mitigation deadline. Because Lazarus Group is exploiting this in the wild via crafted web pages, review endpoint telemetry for suspicious browser-borne activity and warn users against opening links from untrusted or decoy game/job-lure sites.

CVE-2024-5274 is a type confusion flaw (CWE-843) in the V8 JavaScript engine of Google Chrome prior to 125.0.6422.112. A remote attacker can trigger it by persuading a user to open or interact with a crafted HTML page. Successful exploitation allows the attacker to execute arbitrary code inside the browser's sandbox, and the scope-changed CVSS scoring indicates potential impact beyond the browser process itself. Anyone running an affected Chrome or Chromium build, including Chromium-derived distributions such as Fedora's Chromium package, is exposed. The flaw was added to CISA's KEV on 2024-05-28, a public PoC reference exists, and related news reports describe it as actively exploited in the wild.

Do: Upgrade Google Chrome to 125.0.6422.112 or later and confirm the build via chrome://version; Fedora users and users of Chromium-derived browsers should install the corresponding updated packages from their vendor. Because the flaw is listed in CISA KEV, federal agencies and targeted organizations must apply the vendor fix or discontinue use per the required action, and all users should avoid untrusted web content until patched.