Google fixes eighth actively exploited Chrome zero-day this year, the third in a month

Google rolled out a new emergency security update to fix another actively exploited zero-day vulnerability in the Chrome browser.

Google has released a new emergency security update to address a new vulnerability, tracked as CVE-2024-5274, in the Chrome browser, it is the eighth zero-day exploited in attacks disclosed this year.

The vulnerability is a high-severity ‘type confusion’ in the V8 JavaScript engine, the Google researcher Clément Lecigne and Brendon Tiszka discovered it. The company confirmed that the flaw is exploited in attacks in the wild.

“Type Confusion in V8. Reported by Clément Lecigne of Google’s Threat Analysis Group and Brendon Tiszka of Chrome Security on 2024-05-20” reads the security advisory. “Google is aware that an exploit for CVE-2024-5274 exists in the wild.”

A “type confusion” vulnerability occurs when a program incorrectly handles variables of one type as if they were another type. This can happen due to flaws in type checking, casting, or other operations involving variable types, leading to unpredictable behavior and potential security risks.

As usual, Google did not publish details about the attacks exploiting the vulnerability.

“Access to bug details and links may be kept restricted until a majority of users are updated with a fix. We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven’t yet fixed.” continues the advisory.

Google addressed the issue with the release of version 125.0.6422.112/.113 for Windows and Mac, while Linux users will get the update on version 125.0.6422.112 in the coming weeks.

Below is the list of actively exploited zero-day vulnerabilities in the Chrome browser that have been fixed this year:

• CVE-2024-0519: an out of bounds memory access in the Chrome JavaScript engine. (January 2024)
• CVE-2024-2887:  a type of confusion issue that resides in WebAssembly. Manfred Paul demonstrated the vulnerability during the Pwn2Own 2024. (March 2024)
• CVE-2024-2886: a use after free issue that resides in the WebCodecs. The flaw was demonstrated by Seunghyun Lee (@0x10n) of KAIST Hacking Lab during the Pwn2Own 2024. (March 2024)
• CVE-2024-3159: an out-of-bounds memory access in V8 JavaScript engine. The flaw was demonstrated by Edouard Bochin (@le_douds) and Tao Yan (@Ga1ois) of Palo Alto Networks during the Pwn2Own 2024 on March 22, 2024. (March 2024)
• CVE-2024-4671: a use-after-free issue that resides in the Visuals component (May 2024). 
• CVE-2024-4761: an out-of-bounds write issue that resides in the V8 JavaScript engine (May 2024).
• CVE-2024-4947:  a type confusion that resides in V8 JavaScript engine (May 2024). 

The vulnerability CVE-2024-4947 is the third actively exploited zero-day disclosed this month, after CVE-2024-4671 and CVE-2024-4947.

Pierluigi Paganini

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

(SecurityAffairs – hacking, Google)