There is no end in sight for Google and its Chrome browser, now hit by CVE-2024-4947, a zero-day vulnerability. It is the third in just a few days, following the one we covered two days ago: CVE-2024-4761.
CVE-2024-4947: what you need to know
This flaw is a type confusion in the V8 JavaScript and WebAssembly engine. Unlike the previous vulnerabilities, this one was not reported anonymously but by Vasily Berdnikov (@vaber_b) and Boris Larin (@oct0xor) of Kaspersky on 13 May 2024.
The vulnerability has been rated high severity, and Google is aware that an exploit already exists in the wild. As usual, the company is not disclosing further details to avoid making the situation worse, and recommends applying the patch.
Patch and update
On 15 May 2024, the Chrome team announced the availability of Chrome 125 on the stable channel for Windows, Mac and Linux. The new version, 125.0.6422.60 for Linux and 125.0.6422.60/.61 for Windows and Mac, will roll out gradually over the coming days and weeks.
We were on version 124; it is time to move to version 125, which brings many fixes and improvements, listed in detail in the changelog, including of course CVE-2024-4947.
If you don’t want to wait for the automatic update, you can force it by going to Settings and then About Chrome.
On a reassuring note, we learn that many security bugs are detected using specialised tools such as AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity, libFuzzer and AFL.
These tools strengthen the browser’s security and stability by identifying and fixing vulnerabilities before they can be exploited.
CVEs fixed by the update
- CVE-2024-4947: type confusion in the V8 JavaScript engine.
- CVE-2024-4948: use after free in Dawn.
- CVE-2024-4949: use after free in the V8 JavaScript engine.
- CVE-2024-4950: inappropriate implementation in Downloads.
Leave a Reply