CVE-2024-4761KEV · OVERDUE

Google Chromium V8 Out-of-Bounds Memory Write Vulnerability

High · published May 14, 2024

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 8.3. It is confirmed in active exploitation. It sits in the 95.9th percentile for exploit probability.

870
days past CISA
deadline
CVSS v3.1
8.3
EPSS
11%
Percentile
95.9
In the wild
Confirmed
What it is

⚡ A crafty HTML page is all it takes to exploit this out-of-bounds write vulnerability in Google Chrome! 🚨 Think of it like a waiter who delivers your order to the wrong table, causing chaos and confusion—here, a rogue HTML page wreaks havoc on memory allocations, opening the door for attackers. An attacker could potentially execute arbitrary code, leading to a full system compromise. This means they could steal sensitive data, take control of your device, or cause all sorts of digital mischief. It's a nightmare waiting to happen!

Put simply

Think of it like a waiter who delivers your order to the wrong table, causing chaos and confusion—here, a rogue HTML page wreaks havoc on memory allocations, opening the door for attackers. This vulnerability in V8 allows an out-of-bounds memory write, meaning attackers can manipulate memory outside of intended boundaries, effectively injecting malicious code via specially crafted HTML pages.

What to do

An attacker could potentially execute arbitrary code, leading to a full system compromise. This means they could steal sensitive data, take control of your device, or cause all sorts of digital mischief. It's a nightmare waiting to happen! Update Google Chrome to version 124.0.6367.207 or later immediately to close this security gap. Regularly check for updates to ensure you are protected from future exploits. 🛡️ You’ve got this! Stay proactive, and you’ll keep your system safe and sound! ✨

The record
Technical detail
CVSS v3.1
8.3 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.11007 · 95.9th percentile
Published
2024-05-14T02:09Z
KEV added
2024-05-16 · due 2024-06-06
EPSS history
Timeline
  • 16 MAY 00:00Z
    Added to CISA KEV — remediate by Jun 6
    kev
  • 14 MAY 02:09Z
    Out of bounds write in V8 in Google Chrome prior to 124.0.6367.207 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page
    cvelistv5