Google issues emergency Chrome update to patch critical new vulnerability - SiliconANGLE (2024)

FAQs

Does Chrome have a serious security vulnerability? ›

CVE-2024-7971—the vulnerability that has been successfully attacked—is a type confusion in V8, a typical memory issue for a Chrome zero-day, which “allows a remote attacker to exploit heap corruption via a crafted HTML page.” This means an attacker can potentially exploit this to destabilize a PC, compromise data or ...

OVERVIEW: Multiple vulnerabilities have been discovered in Google Chrome, the most severe of which could allow for arbitrary code execution. Successful exploitation of the most severe of these vulnerabilities could allow for arbitrary code execution in the context of the logged on user.

Technical details on the zero-day vulnerability

The zero-day vulnerability which is being fixed here is referred to as CVE-2024-7971: a type confusion in V8 in Google Chrome which allowed a remote attacker to exploit heap corruption via a crafted HTML page.

To check if your Chrome is up-to-date, tap the three-dot menu on the top right and head to Settings. Click on Privacy and security → Safety Check.

The warning highlights multiple vulnerabilities in Google Chrome that could allow remote attackers to execute arbitrary code on targeted systems. To avoid these targeted attacks, users are strongly advised to update their browsers immediately.

Phishing and malware detection is turned on by default in Chrome. When you encounter phishing, malware, unwanted software, or social engineering sites, you may get a red warning that says "Dangerous site." If you see this warning, we recommend that you don't visit the site.

Unwanted extensions: You are seeing new, unwanted programs on your web browser that you didn't install. These might be toolbars, extensions, or add-ons that popped up seemingly out of nowhere. If you experience these signs of malware, you may be dealing with a browser hijacker.

Pop-ups on web pages or in your browser are always fake. 📌 Note: Don't mix up virus alerts with browser security warnings. Browsers often warn you about unsafe websites, but those aren't virus alerts.

Many of these impair the security of the system and are thus vulnerabilities. Although the basis of only a minority of cyberattacks, zero-days are considered more dangerous than known vulnerabilities because there are fewer countermeasures possible.

What is the new Google Chrome zero-day vulnerability being exploited in the wild? ›

"Google is aware that an exploit for CVE-2024-7971 exists in the wild," the company said in an advisory published on Wednesday. This high-severity zero-day vulnerability is caused by a type confusion weakness in Chrome's V8 JavaScript engine.

0.0 Day” vulnerability. This vulnerability allows malicious websites to bypass browser security and interact with services running on an organization's local network, potentially leading to unauthorized access and remote code execution on local services by attackers outside the network.

What to do if Chrome won't update. If your Chrome app won't update and you're seeing an error message, try removing extensions that you don't use — this may also help speed up your browser. If Chrome still won't update, try uninstalling Chrome completely and reinstalling it from the official Google Chrome site.

Google and Google Chrome are two essential elements of the modern internet landscape, often used interchangeably but serving distinct functions. Google is a global technology company best known for its search engine, while Google Chrome is a web browser developed by Google to access the internet and view web pages.

Chrome continuously checks if your browser is set up securely. It makes sure you have the latest security updates, checks your passwords and extensions for potential security risks, and resets permissions from unused sites to protect your privacy.

Chrome is secure by default, protecting you from dangerous and deceptive sites that might steal your passwords or infect your computer. Advanced technologies, such as site isolation, sandboxing, and predictive phishing protections, keep you and your data safe.

A research revealed that Google Chrome is the most vulnerable browser in 2022 with 303 vulnerabilities so far.

Built-in security, out of the box

ChromeOS has features like verification at boot, a read-only OS that blocks executables, data encryption, sandboxing, and more.