Log in Start free

Actively exploited · Published Aug 21, 2024 · Assigned by Chrome

CVE-2024-7971

High 8.8 Exploited

In plain English

A high-severity type confusion in Chrome from Google. Attackers are actively exploiting it in the wild (listed by CISA on August 26, 2024). The chance it is exploited in the next 30 days is estimated at 21.0% (higher than 98% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.8High
Exploit odds (30 days)21.0%top 2.4% of all CVEs
Exploited in the wildYesCISA KEV since Aug 26, 2024
Attack tooling1Public PoC

CISA guidance

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Federal agencies must remediate by Sep 16, 2024.

Official description

Type confusion in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20qt5-qtwebengine5.15.16-r11ALPINE-CVE-2024-7971
Alpine:v3.21qt5-qtwebengine5.15.17-r2ALPINE-CVE-2024-7971
Alpine:v3.22qt5-qtwebengine5.15.17-r2ALPINE-CVE-2024-7971
Alpine:v3.23qt5-qtwebengine5.15.17-r2ALPINE-CVE-2024-7971
Alpine:v3.21qt6-qtwebengine6.7.2-r3ALPINE-CVE-2024-7971
Alpine:v3.22qt6-qtwebengine6.7.2-r3ALPINE-CVE-2024-7971
Alpine:v3.23qt6-qtwebengine6.7.2-r3ALPINE-CVE-2024-7971
Alpine:v3.24qt6-qtwebengine6.7.2-r3ALPINE-CVE-2024-7971
Debian:12chromium128.0.6613.84-1~deb12u1DEBIAN-CVE-2024-7971
Debian:12chromium128.0.6613.84-1~deb12u1DSA-5757-1
Debian:13chromium128.0.6613.84-1DEBIAN-CVE-2024-7971
Debian:14chromium128.0.6613.84-1DEBIAN-CVE-2024-7971

Affected products (as reported)

VendorProductVersions
Google Chrome 128.0.6613.84 – before 128.0.6613.84

Weakness: CWE-843 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References