Google has issued an urgent security update on Thursday to address a zero-day vulnerability in Chrome, identified as CVE-2024-4671. The tech giant confirmed that this high-severity flaw has been actively exploited in the wild and was initially reported by an anonymous researcher on May 7, 2024.
The vulnerability is described as a case of use-after-free in the Visuals component. Use-after-free bugs occur when a program references a memory location after it has been deallocated, leading to a range of potential issues, from crashes to arbitrary code execution.
"Google is aware that an exploit for CVE-2024-4671 exists in the wild," the company stated in an advisory, without providing further details about the real-world attacks or the identity of the threat actors behind them.
This marks the second time Google has addressed actively exploited zero-days in Chrome since the start of the year. In January, the company patched an out-of-bounds memory access problem in the V8 JavaScript and WebAssembly engine (CVE-2024-0519, CVSS score: 8.8) that could result in a crash.
In addition, Google addressed three other zero-day vulnerabilities that were disclosed during the Pwn2Own hacking contest in Vancouver in March. These include:
- CVE-2024-2886 - Use-after-free in WebCodecs
- CVE-2024-2887 - Type confusion in WebAssembly
- CVE-2024-3159 - Out-of-bounds memory access in V8
To mitigate potential threats, users are urged to upgrade to Chrome version 124.0.6367.201/.202 for Windows and macOS, and version 124.0.6367.201 for Linux. Users of Chromium-based browsers such as Microsoft Edge, Brave, Opera, and Vivaldi are also advised to apply the fixes as soon as they become available.
