Two Chrome zero-days, CVE-2024-7965 and CVE-2024-7971, were exploited in the wild before Google fixed them. Both are flaws in the V8 JavaScript engine that a crafted web page can trigger. Chrome 128.0.6613.84 (Linux) and 128.0.6613.84/.85 (Windows and Mac) contain the fixes, so update Chrome to that version or later.
What is CVE-2024-7965 in Chrome?
Google has recently confirmed that two zero-day vulnerabilities, CVE-2024-7965 and CVE-2024-7971, have been actively exploited in the wild, posing a significant threat to Chrome users. CVE-2024-7965, with a CVSS score of 8.8, affects the V8 JavaScript engine in Chrome. This flaw involves improper implementation within the engine, enabling remote attackers to exploit heap corruption through a maliciously crafted HTML page, potentially allowing them to execute arbitrary code on the target system.
What is CVE-2024-7971?
The related vulnerability, CVE-2024-7971, also resides in the V8 JavaScript engine and is due to a type confusion weakness. Both vulnerabilities have been actively exploited, prompting Google to update its security advisory on August 26, 2024, to reflect the ongoing risks. The Cybersecurity and Infrastructure Security Agency (CISA) has also added CVE-2024-7971 to its Known Exploited Vulnerabilities (KEV) Catalog, highlighting the urgency of the situation.
Which Chrome version fixes both zero-days?
In response, Google has released patches for both CVE-2024-7965 and CVE-2024-7971 in Chrome version 128.0.6613.84/.85 for Windows and macOS, and version 128.0.6613.84 for Linux. Chrome users are strongly urged to update their browsers immediately to protect against potential exploitation and secure their systems from these critical vulnerabilities.
Who exploited the Chrome zero-days?
Microsoft’s threat intelligence report ties CVE-2024-7971 to Citrine Sleet, a North Korean state-sponsored actor that mainly targets financial institutions and people who manage cryptocurrency. Victims were sent to a malicious domain, probably through social engineering, and received the V8 exploit there. After code ran in the browser renderer, the attackers used a Windows kernel flaw (CVE-2024-38106) to escape the sandbox and then installed the FudModule rootkit. The report concerns CVE-2024-7971 only.
How serious are the two scores?
The NVD entry for CVE-2024-7971 shows a CVSS score of 9.6 with a changed scope, because a crafted page can break out of the browser’s own boundaries. CVE-2024-7965 is scored 8.8. Both need a user to visit a malicious page, which is why phishing links and ads are the usual delivery route. CISA added CVE-2024-7971 to its Known Exploited Vulnerabilities catalog on 26 August 2024 and CVE-2024-7965 on 28 August 2024, with due dates of 16 and 18 September 2024 for federal agencies.
Chrome is not the only affected browser. Other browsers built on Chromium share the V8 engine, so Microsoft lists Edge version 128.0.2739.42 or later as the fixed build for its own browser.
- Update Chrome to 128.0.6613.84 or laterOpen the browser menu, choose Help, then About Google Chrome, and relaunch.
- Update Edge to 128.0.2739.42 or laterOther Chromium browsers need their own updates.
- Force the update on managed devicesCheck version reports, not just policy settings.
- Install the Windows updates for CVE-2024-38106 and CVE-2024-38193They close the later steps of the attack chain.
- Block the domains named in Microsoft’s reportTwo of them are weinsteinfrog.com and voyagorclub.space.