CVE-2024-4947

Published May 15, 2024

Last updated 8 months ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2024-4947 is a type confusion vulnerability found in the V8 JavaScript engine of Google Chrome before version 125.0.6422.60. This flaw was reported to Google by Vasily Berdnikov and Boris Larin of Kaspersky. The vulnerability affects Chrome browsers on Windows, Mac, and Linux. This vulnerability allows a remote attacker to execute arbitrary code inside a sandbox by using a crafted HTML page. A type confusion vulnerability occurs when a program attempts to access a resource using an incompatible type, potentially leading to out-of-bounds memory access and code execution.

Description: Type Confusion in V8 in Google Chrome prior to 125.0.6422.60 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
Source: chrome-cve-admin@google.com
NVD status: Analyzed

Risk scores

CVSS 3.1

Type: Primary
Base score: 9.6
Impact score: 6
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Severity: CRITICAL

Known exploits

Data from CISA

Vulnerability name: Google Chromium V8 Type Confusion Vulnerability
Exploit added on: May 20, 2024
Exploit action due: Jun 10, 2024
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Weaknesses

nvd@nist.gov: CWE-843
134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-843

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "9EA6CD11-7561-41B3-B56A-B6D0F242EE50",
            "versionEndExcluding": "125.0.6422.60"
          }
        ],
        "operator": "OR"
      }
    ]
  },
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "CC559B26-5DFC-4B7A-A27C-B77DE755DFF9"
          },
          {
            "criteria": "cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "B8EDB836-4E6A-4B71-B9B2-AA3E03E0F646"
          },
          {
            "criteria": "cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "CA277A6C-83EC-4536-9125-97B84C4FAF59"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.