Google fixed the first actively exploited Chrome zero-day of 2024

Google has addressed the first Chrome zero-day vulnerability of the year that is actively being exploited in the wild.

Google has released security updates to address the first Chrome zero-day vulnerability of the year that is actively being exploited in the wild.

The high-serverity vulnerability, tracked as CVE-2024-0519, is an out of bounds memory access in the Chrome JavaScript engine. The flaw was reported by Anonymous on January 11, 2024.

“The Stable channel has been updated to 120.0.6099.234 for Mac and 120.0.6099.224 for Linux and 120.0.6099.224/225 to Windows which will roll out over the coming days/weeks.” reads the security advisory published by the IT giant. “Google is aware of reports that an exploit for CVE-2024-0519 exists in the wild.”

A remote attacker can exploit the flaw by tricking a user into visiting a crafted HTML page to potentially exploit heap corruption.

As usual, Google did not share details of the attacks that exploited the CVE-2024-0519 zero-day in the wild.

Google also fixed the following vulnerabilities:

• [$16000][1515930] High CVE-2024-0517: Out of bounds write in V8. The flaw has been reported by Toan (suto) Pham of Qrious Secure on 2024-01-06
• [$1000][1507412] High CVE-2024-0518: Type Confusion in V8. The flaw has been reported by Ganjiang Zhou(@refrain_areu) of ChaMd5-H1 team on 2023-12-03

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Chrome zero-day)