CVE-2024-9603
Access of Resource Using Incompatible Type ('Type Confusion') (CWE-843)
Summary
Type Confusion vulnerability in V8 in Google Chrome prior to version 129.0.6668.100 allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This is classified as a high-severity issue by Chromium security standards.
Impact
This vulnerability could lead to heap corruption, which is a serious security issue. The potential impacts include: 1. Remote Code Execution (RCE): An attacker could potentially execute arbitrary code on the victim's system. 2. Information Disclosure: Sensitive data stored in memory could be exposed. 3. Denial of Service: The application could crash or become unresponsive. 4. Privilege Escalation: In some cases, the attacker might be able to gain elevated privileges on the system. The attack vector is network-based, requiring user interaction (likely visiting a malicious webpage). The vulnerability has high impact on confidentiality, integrity, and availability of the system.
Exploitation
There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.
Patch
A patch is available. Google Chrome versions 129.0.6668.100 and later have addressed this vulnerability. Users and administrators should update to the latest version of Google Chrome immediately.
Mitigation
1. Update Google Chrome to version 129.0.6668.100 or later immediately. 2. Enable automatic updates for Google Chrome to ensure timely application of security patches. 3. Implement browser isolation technologies to contain potential exploits. 4. Educate users about the risks of visiting untrusted websites. 5. Consider using ad-blockers and script-blockers to reduce exposure to potentially malicious content. 6. Monitor for any unusual activity or crashes in Chrome that could indicate exploitation attempts. 7. In enterprise environments, consider using group policies to force updates and restrict access to potentially dangerous sites.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Timeline
Feedly found the first article mentioning CVE-2024-9603. See article
Feedly estimated the CVSS score as HIGH
NVD published the first details for CVE-2024-9603
Detection for the vulnerability has been added to Nessus (208278)
Detection for the vulnerability has been added to Nessus (208279)
EPSS Score was set to: 0.04% (Percentile: 9.7%)
A CVSS base score of 8.8 has been assigned.
CVE-2024-9603 is a high-severity Type Confusion vulnerability in V8 within Google Chrome prior to version 129.0.6668.100, with a CVSS base score of 8.8, allowing potential remote code execution and other serious impacts. Currently, there is no evidence of exploitation in the wild or public proof-of-concept exploits, but a patch is available in the latest Chrome version, and detection has been added to Nessus vulnerability scanners. Mitigations include updating Chrome, enabling automatic updates, and educating users about risks associated with untrusted websites. See article
Detection for the vulnerability has been added to Nessus (208452)