Out-of-bounds write in Google Chromium - CVE-2024-4761

Vulnerability identifier: #VU89420

CSH Severity: Critical

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-4761

CWE-ID: CWE-787

Exploitation vector: Remote access

Exploit availability: The vulnerability is being exploited in the wild

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing untrusted HTML content in V8. A remote attacker can create a specially crafted web page, trick the victim into opening it, trigger out-of-bounds write and execute arbitrary code on the target system.

Note, the vulnerability is being actively exploited in the wild.

Google Chromium
Microsoft Edge
Google Chrome
Gentoo Linux
Debian Linux
Fedora
Chrome OS
Dell Hybrid Client
PowerVault ME5
chromium
dev-qt/qtwebengine
www-client/opera
www-client/microsoft-edge
www-client/chromium
www-client/google-chrome
chromium (Debian package)

Install update from vendor's website.

Google Chromium - update to 124.0.6367.207
Microsoft Edge - update to 124.0.2478.105
Google Chrome - update to 124.0.6367.207
chromium - addressed in versions 125.0.6422.60-1.el8, 125.0.6422.60-1.el9, 125.0.6422.60-1.fc38, 125.0.6422.60-1.fc39, 125.0.6422.60-1.fc40, 125.0.6422.76-1.el7, 125.0.6422.76-1.el8, 125.0.6422.76-1.el9
PowerVault ME5 - update to 1.2.2.1
Chrome OS - update to 120.0.6099.312
dev-qt/qtwebengine - update to 103.0.5060.53
www-client/opera - update to 114.0.5282.21
www-client/microsoft-edge - update to 128.0.2739.42
www-client/chromium - update to 128.0.6613.84
www-client/google-chrome - update to 128.0.6613.84
chromium (Debian package) - update to 124.0.6367.207-1~deb12u1

• https://chromereleases.googleblog.com/2024/05/stable-channel-update-for-desktop_13.html
• https://crbug.com/339458194

• Remote code execution in Google Chrome
• Remote code execution in Microsoft Edge
• Fedora 39 update for chromium
• Fedora 40 update for chromium
• Fedora 38 update for chromium
• Fedora EPEL 9 update for chromium
• Fedora EPEL 8 update for chromium
• Fedora EPEL 9 update for chromium
• Fedora EPEL 7 update for chromium
• Fedora EPEL 8 update for chromium
• Multiple vulnerabilities in Google ChromeOS TLS
• Debian update for chromium
• Multiple vulnerabilities in Dell Hybrid Client
• Gentoo update for QtWebEngine
• Multiple vulnerabilities in Dell PowerVault ME5
• Gentoo update for Chromium, Google Chrome, Microsoft Edge. Opera