Google Warns of Actively Exploited Chrome Security Flaw CVE-2024-7965

Google has issued a warning regarding a critical security flaw in its Chrome browser, identified as CVE-2024-7965, which has reportedly come under active exploitation in the wild. This revelation follows the release of a recent software update aimed at patching the vulnerability, underscoring the importance of keeping software up to date to protect against emerging threats.

The Nature of CVE-2024-7965

The CVE-2024-7965 vulnerability has been classified as an inappropriate implementation bug in Chrome’s V8 JavaScript and WebAssembly engine. V8 is a key component that enables Chrome to efficiently execute JavaScript, a scripting language that powers much of the interactive content on the web. The flaw could allow a remote attacker to exploit heap corruption via a specially crafted HTML page, leading to potential arbitrary code execution or other malicious activities.

According to the National Institute of Standards and Technology’s (NIST) National Vulnerability Database (NVD), the flaw existed in Chrome versions prior to 128.0.6613.84. This means that users running older versions of Chrome are at risk and should update their browsers immediately to mitigate any potential threats.

Discovery and Response

The discovery of CVE-2024-7965 is credited to a security researcher known by the online pseudonym “TheDog.” The researcher identified the flaw on July 30, 2024, and reported it to Google through the company’s bug bounty program. For their efforts, TheDog was awarded a bug bounty of $11,000—a testament to the importance Google places on identifying and patching vulnerabilities before they can be exploited by malicious actors.

Google has acknowledged the existence of an exploit for CVE-2024-7965, noting that the vulnerability has been actively exploited in the wild. However, the tech giant has not disclosed specific details about the nature of these attacks or the identity of the threat actors involved. This lack of information is not uncommon in the cybersecurity industry, as companies often withhold certain details to prevent further exploitation or to allow time for users to update their systems.

The timing of the exploitation is also unclear. Google has stated that the “in the wild exploitation of CVE-2024-7965 […] was reported after this release,” raising questions about whether the flaw was weaponized as a zero-day vulnerability before its disclosure. A zero-day refers to a vulnerability that is exploited before the affected software provider has released a patch, leaving users exposed to attacks.

Chrome’s Security Challenges in 2024

The disclosure of CVE-2024-7965 adds to a growing list of security challenges for Google in 2024. Since the beginning of the year, Google has addressed nine zero-day vulnerabilities in Chrome, several of which were demonstrated at the prestigious Pwn2Own hacking competition. These vulnerabilities include:

1. CVE-2024-0519 – Out-of-bounds memory access in V8
2. CVE-2024-2886 – Use-after-free in WebCodecs (demonstrated at Pwn2Own 2024)
3. CVE-2024-2887 – Type confusion in WebAssembly (demonstrated at Pwn2Own 2024)
4. CVE-2024-3159 – Out-of-bounds memory access in V8 (demonstrated at Pwn2Own 2024)
5. CVE-2024-4671 – Use-after-free in Visuals
6. CVE-2024-4761 – Out-of-bounds write in V8
7. CVE-2024-4947 – Type confusion in V8
8. CVE-2024-5274 – Type confusion in V8
9. CVE-2024-7971 – Type confusion in V8

The recurrence of vulnerabilities in the V8 engine is particularly concerning, as this component is central to the browser’s functionality. Type confusion and out-of-bounds memory access issues, which are common in the reported vulnerabilities, can lead to serious security risks, including arbitrary code execution and system compromise.