Google Chrome Vulnerabilities

 

In today’s SensCy Cyber Alert, your SensCy team recommends Google Chrome Browser users to install the new Chrome Version immediately. Prompt action is the only way to safeguard your data against critical Google Chrome vulnerabilities.

The new update patches a Zero-Day vulnerability currently exploited by threat actors. Because this flaw is actively being used in the wild, it poses a significantly higher risk than standard Google Chrome vulnerabilities.

The high-severity zero-day vulnerability can be tracked as CVE-2024-7971 and is caused by a type confusion weakness in Chrome’s V8 JavaScript engine. Understanding the mechanisms behind these Google Chrome vulnerabilities is vital for assessing organizational risk.

Below are the new available updates designed to patch these Google Chrome vulnerabilities:

  • Windows and Mac: Chrome prior to 128.0.6613.84/.85
  • Linux: Chrome prior to 128.0.6613.84

Key Takeaways

  • Active Exploitation Warning: Google has released an emergency update to fix a zero-day vulnerability (CVE-2024-7971) that hackers are currently using in attacks.
  • Technical Root Cause: The flaw is a “type confusion” weakness located in Chrome’s V8 JavaScript engine, which can lead to system compromise.
  • Immediate Action: Windows and Mac users need version 128.0.6613.84/.85, and Linux users need 128.0.6613.84 to secure their browsers.
  • Manual Update Recommended: Users should manually trigger the update process immediately rather than waiting for automatic background installation.

How to check for new updates:

For new Google Chrome updates, follow these steps:

  1. On your computer, open Chrome.
  2. At the top right, click the ellipsis (…).
  3. Click Help and then About Google Chrome.
  4. Click Update Google Chrome.

Important: If your Chrome browser is up-to-date, you will see a blue check mark and the words “Chrome is up to date.”

Frequently Asked Questions (FAQ)

1. What is a “Zero-Day” vulnerability?

A Zero-Day vulnerability is a software flaw that is discovered by attackers before the software vendor (in this case, Google) is aware of it or has a patch ready. Because “zero days” have passed since the developer learned of the issue, no defense existed until the update was released, making immediate patching critical.

2. What is the V8 JavaScript engine?

The V8 engine is the open-source component of Chrome that executes JavaScript code. It is responsible for making modern web pages interactive. Vulnerabilities here, like CVE-2024-7971, are dangerous because simply visiting a malicious website can trigger the exploit.

3. What does “Type Confusion” mean?

Type confusion is a bug where the program is tricked into accessing a piece of memory using the wrong “type” (e.g., treating a number as a pointer to a memory address). This confusion allows hackers to crash the browser or, in severe cases, execute malicious code on your computer.

4. Why should I update manually instead of waiting?

While Chrome updates automatically, the process can take days or weeks to reach all users globally. Since this specific vulnerability is being “actively exploited” (hackers are using it right now), waiting for the automatic update leaves you exposed to immediate attacks. Manual updating ensures you are protected instantly.

If you need additional assistance, use this Google Chrome link.