Google Chrome Vulnerabilities

Key Takeaways

  • Urgent Action: Update Google Chrome immediately to version 131.0.6778.204/.205 (Windows/Mac) or 131.0.6778.204 (Linux).
  • High-Severity Patches: The update fixes four critical security flaws found in the V8 JavaScript engine and Compositing components.
  • Attack Vector: Remote attackers can exploit these flaws using specially crafted HTML pages to execute malicious code on your device.
  • Specific Risks: The vulnerabilities include Type Confusion, Out-of-bounds memory access, and Use-after-free errors.

Google Chrome Vulnerabilities: High-Severity Security Update

In today’s SensCy Cyber Alert, we recommend all Google Chrome users update to the latest version immediately to protect against recently discovered Google Chrome vulnerabilities.

The new release addresses four high-severity security vulnerabilities. These issues stem from weaknesses in the browser’s V8 JavaScript engine and Compositing component. If exploited, these Google Chrome vulnerabilities could allow remote attackers to execute malicious code or compromise system integrity via specially crafted HTML pages.

Below is a breakdown of the specific Google Chrome vulnerabilities patched in this release:

  • CVE-2024-12692 (High): Type Confusion in V8.
  • CVE-2024-12693 (High): Out of bounds memory access in V8.
  • CVE-2024-12694 (High): Use after free in compositing.
  • CVE-2024-12695 (High): Out of bounds write in V8.

To ensure you are protected against these Google Chrome vulnerabilities, please verify your browser version matches the available updates below:

  • Windows and Mac: Chrome prior to 131.0.6778.204/.205
  • Linux: Chrome prior to 131.0.6778.204

How to check for new updates:

For new Google Chrome updates, follow these steps:

  1. On your computer, open Chrome.
  2. At the top right, click the ellipsis (…).
  3. Click Help and then About Google Chrome.
  4. Click Update Google Chrome.

Important: If your Chrome browser is up-to-date, you will see a blue check mark and the words “Chrome is up to date.”

Frequently Asked Questions (FAQ)

1. What is the V8 JavaScript Engine?

V8 is Google’s open-source high-performance JavaScript and WebAssembly engine. It is the part of the browser that reads and executes the code that makes websites interactive. Vulnerabilities here (like CVE-2024-12692) are dangerous because they happen deep within the browser’s core processing logic.

2. What does “Type Confusion” mean?

Type Confusion is a vulnerability where the program is tricked into accessing a piece of memory using the wrong “type” (e.g., treating a number as a pointer to a memory address). This confusion can lead to crashes or allow an attacker to read/write memory they shouldn’t have access to, potentially leading to code execution.

3. How does a “crafted HTML page” exploit my computer?

Attackers embed malicious code into a website. When you visit that site (or view a malicious ad/pop-up), the browser attempts to render the HTML and execute the JavaScript. If the browser has these vulnerabilities, the malicious code triggers the flaw (like the “Out of bounds write”), allowing the attacker to break out of the browser’s sandbox and run commands on your actual operating system.

4. Why are “Use After Free” errors dangerous?

“Use After Free” occurs when a program tries to use memory after it has already been cleared or “freed.” If an attacker can manipulate the data in that freed memory slot before the program tries to use it again, they can corrupt valid data or hijack the program’s control flow to execute their own malware.

If you need additional assistance, use this Google Chrome link.