Aperçu
A type confusion vulnerability in Google Chrome's V8 JavaScript engine allows remote attackers to execute arbitrary code within the Chrome sandbox by crafting a malicious HTML page. The vulnerability exists in versions prior to 125.0.6422.112. La vulnérabilité a été divulguée le May 28, 2024. CISA a identifié CVE-2024-5274 comme étant exploitée mais n'est pas actuellement connue pour être utilisée dans des campagnes de rançongiciel.
Détails techniques
A type confusion vulnerability in Google V8 JavaScript engine (used in Chrome) allows attackers to craft a malicious HTML page that triggers improper type handling. When a victim visits the malicious webpage, the vulnerability can be exploited to execute arbitrary code within the Chrome sandbox environment.
La vulnérabilité est classifiée comme CWE-843 (Access of Resource Using Incompatible Type ('Type Confusion')) .
La vulnérabilité a reçu un score de base CVSS v3.1 de 8.8 (HIGH) avec la chaîne vectorielle CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, indiquant sa nature high.
Impact
Successful exploitation allows remote attackers to execute arbitrary code within the Chrome sandbox. This could lead to data theft, credential harvesting, installation of malware, or lateral movement to compromise the underlying system. The sandbox provides some protection but does not completely prevent system compromise.
Mitigation et contournements
Update Google Chrome to version 125.0.6422.112 or later. Users can check their version in Chrome by clicking the three-dot menu > Help > About Google Chrome, which will automatically check for updates. Les versions suivantes incluent les correctifs nécessaires : 125.0.6422.112 and later.
Comme contournements temporaires : disable javascript in chrome settings as a temporary measure (not practical for most users); avoid visiting untrusted or suspicious websites until the patch is applied, et use alternative browsers temporarily until chrome is updated.
Recommandation de CISA : Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Ressources additionnelles
Source : Ce rapport a été généré par IA
