Article Details
Scrape Timestamp (UTC): 2024-08-26 22:01:55.885
Original Article Text
Click to Toggle View
Google tags a tenth Chrome zero-day as exploited this year. Today, Google revealed that it patched the tenth zero-day exploited in the wild in 2024 by attackers or security researchers during hacking contests. Tracked as CVE-2024-7965 and reported by a security researcher known only as TheDog, the now-patched high-severity vulnerability is described as an inappropriate implementation in Google Chrome's V8 JavaScript engine that can let remote attackers exploit heap corruption via a crafted HTML page. This was announced in an update to a blog post where the company revealed last week that it fixed another high-severity zero-day vulnerability (CVE-2024-7971) caused by a V8 type confusion weakness. "Updated on 26 August 2024 to reflect the in the wild exploitation of CVE-2024-7965 which was reported after this release," the company said in today's update. "Google is aware that exploits for CVE-2024-7971 and CVE-2024-7965 exist in the wild." Google has fixed both zero-days in Chrome version 128.0.6613.84/.85 for Windows/macOS systems and version 128.0.6613.84 Linux users, which have been rolling out to all users in the Stable Desktop channel since Wednesday. Even though Chrome will automatically update when security patches are available, you can also speed up this process and apply the updates manually by going to the Chrome menu > Help > About Google Chrome, letting the update finish, and clicking the 'Relaunch' button to install it. While Google confirmed that the CVE-2024-7971 and CVE-2024-7965 vulnerabilities have been used in the wild, it has yet to share more information regarding these attacks. "Access to bug details and links may be kept restricted until a majority of users are updated with a fix," Google says. "We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven't yet fixed." Since the start of the year, Google has patched eight other zero-days tagged as exploited in attacks or during the Pwn2Own hacking contest:
Daily Brief Summary
Google has addressed its tenth Chrome zero-day vulnerability identified in 2024, designated as CVE-2024-7965, described as an issue in the V8 JavaScript engine allowing heap corruption.
The vulnerability was exploited through a specially crafted HTML page, enabling remote attackers to target users.
Another related high-severity zero-day, CVE-2024-7971, was also recently patched, involving a type confusion issue in the same V8 engine.
Both vulnerabilities have confirmed exploits in the wild, although specific details about the attacks remain undisclosed.
Patches have been issued for Windows, macOS, and Linux under Chrome version 128.0.6613.84/.85, with updates rolling out in the Stable Desktop channel.
Users are advised to update their Chrome browsers immediately by manually triggering the update process if automatic updates have not yet been applied.
Google has been actively restricting detailed information about these vulnerabilities to protect users until the majority has updated their browsers.
This year, including these, Google has patched a total of eight other zero-days that were exploited either in the wild or during the Pwn2Own hacking contest.