ExploitCVE-2024-1939
Access of Resource Using Incompatible Type ('Type Confusion') (CWE-843)
Summary
Type Confusion in V8 in Google Chrome prior to version 122.0.6261.94 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability has been classified as High severity by Chromium.
Impact
This vulnerability could lead to heap corruption, which may result in arbitrary code execution, information disclosure, or denial of service. The CVSS v3.1 score of 8.8 (High) indicates severe potential impacts on confidentiality, integrity, and availability of the affected system. An attacker successfully exploiting this vulnerability could gain the ability to execute arbitrary code within the context of the browser, potentially leading to unauthorized access to sensitive information, modification of data, or disruption of services.
Exploitation
One proof-of-concept exploit is available on github.com. There is no evidence of proof of exploitation at the moment.
Patch
A patch is available. Google has released Chrome version 122.0.6261.94 which addresses this vulnerability. Microsoft has also released an update to address this issue in their Chromium-based browsers.
Mitigation
1. Immediately update Google Chrome to version 122.0.6261.94 or later. 2. For Chromium-based Microsoft browsers, apply the latest Microsoft security updates. 3. Implement network segmentation and restrict access to untrusted websites. 4. Use browser security features like site isolation and content security policies. 5. Educate users about the risks of visiting untrusted websites or opening suspicious links. 6. Consider using browser extensions that block potentially malicious content. 7. Regularly monitor for and apply security updates across all systems and applications.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Timeline
Feedly found the first article mentioning CVE-2024-1939. See article
NVD published the first details for CVE-2024-1939
Detection for the vulnerability has been added to Qualys (6000497)
Detection for the vulnerability has been added to Nessus (191123)
Feedly estimated the CVSS score as HIGH
EPSS Score was set to: 0.04% (Percentile: 6.9%)
A CVSS base score of 8.8 has been assigned.