Google has confirmed the first exploit for a 2024 Chrome web browser zero-day vulnerability and issued an update that should be applied by all users as soon as possible. This follows on from an emergency Google update late in December for another actively exploited zero-day vulnerability in Chrome.
The high criticality zero-day vulnerability has been recorded as CVE-2024-0519 and was reported anonymously to Google on January 11.
What Is CVE-2024-0519 And How Can Google Hackers Use It?
CVE-2024-0519 is an out-of-bounds memory access vulnerability in the open-source JavaScript engine used in Chromium-powered web browsers such as Chrome, Edge, Brave and Opera. V8 was first released in 2008 alongside the Chrome browser and has been something of a constant vulnerability red flag attracting hackers ever since. As is usual with such zero-day issues, Google has declined to publish further technical details of the vulnerability until such a time as most users have had the chance to protect themselves from exploitation.
What little is known, however, reveals this to be something that could enable an attacker to pull off an exploit remotely by way of a user visiting a malicious HTML page on a website. So, social engineering would be required to get a victim to that page in the first place, but we all know how easy that is to pull off. Ultimately, you might expect the hacking end goal to be remote code execution through a secondary vulnerability made accessible after exploiting this.
Indeed, it is likely that CVE-2024-0519 might be used to bypass address space layout randomization, a security function that serves to prevent vulnerabilities within memory corruption processes from being exploited.
How To Update Chrome And Protect Against This Latest Google Zero-Day
Although Google states that it will be updating the relevant security patch across the coming days and weeks, Chrome users are advised to check manually and kickstart the patching process right now. Not least as this Chrome update also patches three other high-rated V8 vulnerabilities:
- CVE-2024-0517 an out-of-bounds write vulnerability
- CVE-2024-0518: a type confusion vulnerability
- CVE-2024-0519: another out-of-bounds memory vulnerability
The fully patched Chrome version numbers are as follows:
- 120.0.6099.230 for Android
- 120.0.6099.234 for Mac
- 120.0.6099.224 for Linux
- 120.0.6099.224/225 for Windows
Check the About option in your browser settings, which will kickstart the update process automatically. Remember that to activate the patch once it has been installed, you will need to restart your browser.
Users of other web browsers that are based on the Chromium project will also need to check that they have been updated to offer protection against this zero-day vulnerability.
Read the full article here
