Tuesday, June 25, 2024

Google Patches Chrome Zero-Day: Type Confusion in V8 JavaScript

Google has released a patch for a zero-day exploit in its Chrome browser.

The vulnerability, identified as CVE-2024-5274, involves a confusion issue in the V8 JavaScript engine, which could allow attackers to execute arbitrary code on affected systems.

CVE-2024-5274 – Details of the Vulnerability

An anonymous security researcher discovered the CVE-2024-5274 vulnerability and promptly reported it to Google.

Type confusion vulnerabilities occur when a program allocates or initializes a resource, such as a variable or object, as one type but later accesses it as a different type.

ANYRUN malware sandbox’s 8th Birthday Special Offer: Grab 6 Months of Free Service

This can lead to unpredictable behavior, including the execution of malicious code.

The flaw resides in V8, the open-source JavaScript engine developed by the Chromium Project for Google Chrome and other Chrome-based browsers.

The V8 engine is responsible for executing JavaScript code, and any vulnerabilities within it can seriously affect browser security.

Google’s Response

Google’s security team quickly addressed the issue, releasing a stable channel update for Chrome on May 23, 2024.

The update, version 114.0.5735.110, includes a fix for the CVE-2024-5274 vulnerability. Users are strongly encouraged to update their browsers immediately to protect against potential exploits.

In a statement on the Chrome Releases blog, Google emphasized the importance of keeping software up to date: “We are aware that an exploit for CVE-2024-5274 exists in the wild. As always, we encourage users to update to the latest version of Chrome to ensure they have the latest security protections.”

The discovery of this zero-day exploit underscores the ongoing need for vigilance in cybersecurity.

Type confusion vulnerabilities can be particularly dangerous because they can be exploited to bypass security mechanisms and gain unauthorized access to systems .

Users can update their Chrome browsers by navigating to the “About Google Chrome” section in the browser’s settings.

The browser will automatically check for and install the latest updates.

Additionally, organizations should ensure that all endpoints are running the latest version of Chrome to mitigate the risk of exploitation.

Google’s prompt action in patching the CVE-2024-5274 vulnerability highlights the company’s commitment to maintaining the security of its browser.

As cyber threats evolve, users and organizations must stay informed about potential vulnerabilities and take proactive measures to protect their systems.

Free Webinar on Live API Attack Simulation: Book Your Seat | Start protecting your APIs from hackers

Website

Latest articles

Hackers Exploit Multiple WordPress Plugins to Hack Websites & Create Rogue Admin Accounts

Wordfence Threat Intelligence team identified a significant security breach involving multiple WordPress plugins. The initial...

Hackers Attacking Windows IIS Server to Upload Web Shells

Windows IIS Servers often host critical web applications and services that provide a gateway...

WikiLeaks Founder Julian Assange Released in Stunning Deal with U.S.

WikiLeaks founder Julian Assange has been released from prison after reaching a deal with...

Four Members of FIN9 Hackers Charged for Attacking U.S. Companies

Four Vietnamese nationals have been charged for their involvement in a series of computer...

BREAKING: NHS England’s Synnovis Hit by Massive Cyber Attack

In a shocking development, the NHS has revealed that it was the victim of...

Threat Actor Claiming a 0-day in Linux LPE Via GRUB bootloader

A new threat actor has emerged, claiming a zero-day vulnerability in the Linux GRUB...

LockBit Ransomware Group Claims Hack of US Federal Reserve

The notorious LockBit ransomware group has claimed responsibility for hacking the U.S. Federal Reserve,...
Divya
Divya
Divya is a Senior Journalist at GBhackers covering Cyber Attacks, Threats, Breaches, Vulnerabilities and other happenings in the cyber world.

Free Webinar

API Vulnerability Scanning

71% of the internet traffic comes from APIs so APIs have become soft targets for hackers.Securing APIs is a simple workflow provided you find API specific vulnerabilities and protect them.In the upcoming webinar, join Vivek Gopalan, VP of Products at Indusface as he takes you through the fundamentals of API vulnerability scanning..
Key takeaways include:

  • Scan API endpoints for OWASP API Top 10 vulnerabilities
  • Perform API penetration testing for business logic vulnerabilities
  • Prioritize the most critical vulnerabilities with AcuRisQ
  • Workflow automation for this entire process

Related Articles