Google has rolled out safety fixes to deal with a high-severity safety flaw in its Chrome browser that it mentioned has come beneath lively exploitation within the wild.
Tracked as CVE-2024-7971, the vulnerability has been described as a sort confusion bug within the V8 JavaScript and WebAssembly engine.
“Sort confusion in V8 in Google Chrome previous to 128.0.6613.84 allowed a distant attacker to take advantage of heap corruption by way of a crafted HTML web page,” in response to a description of the bug within the NIST Nationwide Vulnerability Database (NVD).
The Microsoft Menace Intelligence Heart (MSTIC) and Microsoft Safety Response Heart (MSRC) have been credited with discovering and reporting the flaw on August 19, 2024.
No further particulars in regards to the nature of the assaults exploiting the flaw or the identification of the risk actors which may be weaponizing it have been launched, primarily to make sure that a majority of the customers are up to date with a repair.
The tech large, nevertheless, acknowledged in a terse assertion that it is “conscious that an exploit for CVE-2024-7971 exists within the wild.” It is value mentioning that CVE-2024-7971 is the third sort confusion bug that it has patched in V8 this yr after CVE-2024-4947 and CVE-2024-5274.
Google has to this point addressed 9 zero-days in Chrome because the begin of 2024, together with three that have been demonstrated at Pwn2Own 2024 –
Customers are advisable to improve to Chrome model 128.0.6613.84/.85 for Home windows and macOS, and model 128.0.6613.84 for Linux to mitigate potential threats.
Customers of Chromium-based browsers equivalent to Microsoft Edge, Courageous, Opera, and Vivaldi are additionally suggested to use the fixes as and after they turn out to be accessible.