Pierluigi Paganini
May 24, 2024
Google has released a new emergency security update to address a new vulnerability, tracked as CVE-2024-5274, in the Chrome browser, it is the eighth zero-day exploited in attacks disclosed this year.
The vulnerability is a high-severity ‘type confusion’ in the V8 JavaScript engine, the Google researcher Clément Lecigne and Brendon Tiszka discovered it. The company confirmed that the flaw is exploited in attacks in the wild.
“Type Confusion in V8. Reported by Clément Lecigne of Google’s Threat Analysis Group and Brendon Tiszka of Chrome Security on 2024-05-20” reads the security advisory. “Google is aware that an exploit for CVE-2024-5274 exists in the wild.”
A “type confusion” vulnerability occurs when a program incorrectly handles variables of one type as if they were another type. This can happen due to flaws in type checking, casting, or other operations involving variable types, leading to unpredictable behavior and potential security risks.
As usual, Google did not publish details about the attacks exploiting the vulnerability.
“Access to bug details and links may be kept restricted until a majority of users are updated with a fix. We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven’t yet fixed.” continues the advisory.
Google addressed the issue with the release of version 125.0.6422.112/.113 for Windows and Mac, while Linux users will get the update on version 125.0.6422.112 in the coming weeks.
Below is the list of actively exploited zero-day vulnerabilities in the Chrome browser that have been fixed this year:
The vulnerability CVE-2024-4947 is the third actively exploited zero-day disclosed this month, after CVE-2024-4671 and CVE-2024-4947.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, Google)
