CVE-2024-7971

Aug. 27, 2024, 1 a.m.

8.8
High

Description

Type confusion in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Product(s) Impacted

Vendor Product Versions
Google
  • Chrome
  • *

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-843
Access of Resource Using Incompatible Type ('Type Confusion')
The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.

*CPE(s)

Affected systems and software identified for this CVE.

Type Vendor Product Version Update Edition Language Software Edition Target Software Target Hardware Other Information
a google chrome / / / / / / / /

References

https://chromereleases.googleblog.com/2024/08/stable-channel-update-for-desktop_21.html
https://issues.chromium.org/issues/360700873

Tags

chrome-cve-admin@google.com
CWE-843
2024-08-21
CVE-2024-7971

CVSS Score

8.8 / 10

CVSS Data

  • Attack Vector: NETWORK
  • Attack Complexity: LOW
  • Privileges Required: NONE
  • Scope: UNCHANGED
  • Confidentiality Impact: HIGH
  • Integrity Impact: HIGH
  • Availability Impact: HIGH
    • View Vector String

    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Date

  • Published: Aug. 21, 2024, 9:15 p.m.
  • Last Modified: Aug. 27, 2024, 1 a.m.

Status : Analyzed

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

chrome-cve-admin@google.com

Relations

Here is the list of observables linked to the vulnerability CVE-2024-7971 using threat intelligence.

  • Citrine Sleet
  • Kaolin

Linked Attack Reports

North Korean threat actor Citrine Sleet exploiting Chromium zero-day

Microsoft identified a North Korean threat actor exploiting a zero-day vulnerability in Chromium, now identified as CVE-2024-7971, to gain remote code execution (RCE). Microsoft assess with high confidence that the observed exploitation of CVE-2024-7971 can be attributed to a North Korean threat ac…
fudmodule
CVE-2024-7971
2024-09-02
diamond sleet
citrine sleet
hidden cobra
Published: September 2, 2024
Linked vulnerabilities : CVE-2024-4947, CVE-2024-5274, CVE-2024-38106 (CVSS 7.0), CVE-2024-38193 (CVSS 7.8), CVE-2024-7971 (CVSS 8.8), CVE-2023-42793, CVE-2024-21338
Downloadable IOCs: 2

*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.