Google has released a new emergency Chrome security update to address the third zero-day vulnerability exploited in attacks within a week.
The company fixed the zero-day flaw with the release of 125.0.6422.60/.61 for Mac/Windows and 125.0.6422.60.
Chrome updates automatically when security patches are available.
Users can also confirm they're running the latest version by going to Chrome menu > Help > About Google Chrome, letting the update finish, and then clicking on the 'Relaunch' button to install it.
Today's update was immediately available when BleepingComputer checked for new updates.
The high-severity zero-day vulnerability is caused by a type confusion weakness in the Chrome V8 JavaScript engine reported by Kaspersky's Vasily Berdnikov and Boris Larin.
Even though such vulnerabilities generally enable threat actors to trigger browser crashes by reading or writing memory out of buffer bounds, they can also exploit them for arbitrary code execution on targeted devices.
While Google confirmed the CVE-2024-4947 bug was used in attacks, the company has yet to share more details regarding these incidents.
CVE-2024-0519: A high-severity out-of-bounds memory access weakness within the Chrome V8 JavaScript engine, allowing remote attackers to exploit heap corruption via a specially crafted HTML page, leading to unauthorized access to sensitive information.
CVE-2024-2887: A high-severity type confusion flaw in the WebAssembly standard.
It could lead to remote code execution exploits leveraging a crafted HTML page.
Remote attackers exploited it to perform arbitrary reads and writes via crafted HTML pages, leading to remote code execution.
CVE-2024-3159: A high-severity vulnerability caused by an out-of-bounds read in the Chrome V8 JavaScript engine.
Remote attackers exploited this flaw using specially crafted HTML pages to access data beyond the allocated memory buffer, resulting in heap corruption that could be leveraged to extract sensitive information.
CVE-2024-4671: A high-severity use-after-free flaw in the Visuals component that handles the rendering and displaying content in the browser.
CVE-2024-4761: An out-of-bounds write problem in Chrome's V8 JavaScript engine, which is responsible for executing JS code in the application.
Google Chrome emergency update fixes 6th zero-day exploited in 2024.
Google fixes fifth Chrome zero-day exploited in attacks this year.
Microsoft fixes Windows zero-day exploited in QakBot malware attacks.
Apple backports fix for zero-day exploited in attacks to older iPhones.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Wed, 15 May 2024 22:40:05 +0000