CVE-2024-4947:CVE-2024-4947 is a type confusion vulnerability in Google's Chrome V8 engine that could allow a remote attacker to execute arbitrary code inside the browser sandbox via a crafted HTML page, affecting Chrome versions prior to 125.0.6422.60.

splash
Back

Description Preview

This vulnerability (CWE-843) arises from a type confusion in Chrome’s V8 engine that could be exploited by delivering a specially crafted HTML page. If exploited, it could enable remote code execution within the Chrome sandbox. The issue affects Google Chrome versions before 125.0.6422.60, and is rated High severity with a CVSS v3.1 base score of 9.6. The attack vector is Network, with no privileges required, but user interaction is typically needed. Upgrading to Chrome 125.0.6422.60 or newer mitigates the vulnerability, as this fix was released in that version.

Overview

Google Chrome contains a type confusion vulnerability in the V8 engine that could let a remote attacker run arbitrary code in the browser sandbox through a crafted HTML page. The vulnerability affects Chrome versions prior to 125.0.6422.60 and is classified as High severity (CVSS v3.1 base score 9.6). It requires network access and user interaction, with no special privileges needed, and could impact confidentiality, integrity, and availability. A fix has been released in version 125.0.6422.60 and later.

Remediation

  • Update Chrome to the latest stable release or at least to version 125.0.6422.60 or newer on all endpoints.
  • If managing devices in an organization, ensure automatic updates are enabled (or deploy the update via your standard software update mechanisms) and verify deployment across all systems.
  • After updating, restart Chrome and verify that the version is 125.0.6422.60 or newer on affected devices.
  • If immediate patching isn’t feasible, implement compensating controls to reduce exposure: restrict or sanitize untrusted HTML content where possible, ensure Chrome sandboxing is active, and monitor for indicators of exploitation; plan for rapid patch deployment as soon as possible.
  • Review vendor advisories and release notes related to this CVE, and subscribe to update channels to stay informed about future fixes and mitigations.

References

Early Warning

Customers using Armis Early Warning were notified about this vulnerability before it appeared in CISA's Known Exploited Vulnerabilities Catalog, enabling them to assess their exposure and act proactively. Armis offers these examples of CVEs already included in CISA KEV for potential customers. Click here to learn how to receive alerts earlier.

Armis Alert Date
May 18, 2024
CISA KEV Date
May 20, 2024
2days early

Industry ExposureMost to least
This section illustrates the prevalence of a specific Common Vulnerabilities and Exposures (CVE) across various industries based on customer reports. The ranking displays industries from the most to least affected by this particular vulnerability, offering valuable insight into where this CVE has been most frequently observed. This information can help organizations within these sectors prioritize their security efforts, understand their relative risk exposure compared to their peers, and focus remediation strategies where they are most needed. By understanding the industry-specific impact, organizations can make more informed decisions regarding patching, resource allocation, and overall risk management related to this CVE.

  1. Manufacturing: Medium
    Manufacturing
  2. Public Administration: Medium
    Public Administration
  3. Health Care & Social Assistance: Medium
    Health Care & Social Assistance
  4. Educational Services: Medium
    Educational Services
  5. Transportation & Warehousing: Medium
    Transportation & Warehousing
  6. Finance and Insurance: Medium
    Finance and Insurance
  7. Retail Trade: Medium
    Retail Trade
  8. Professional, Scientific, & Technical Services: Medium
    Professional, Scientific, & Technical Services
  9. Other Services (except Public Administration): Low
    Other Services (except Public Administration)
  10. Arts, Entertainment & Recreation: Low
    Arts, Entertainment & Recreation
  11. Management of Companies & Enterprises: Low
    Management of Companies & Enterprises
  12. Utilities: Low
    Utilities
  13. Information: Low
    Information
  14. Real Estate Rental & Leasing: Low
    Real Estate Rental & Leasing
  15. Accommodation & Food Services: Low
    Accommodation & Food Services
  16. Agriculture, Forestry Fishing & Hunting: Low
    Agriculture, Forestry Fishing & Hunting
  17. Mining: Low
    Mining
  18. Construction: Low
    Construction
  19. Administrative, Support, Waste Management & Remediation Services: Low
    Administrative, Support, Waste Management & Remediation Services
  20. Wholesale Trade: Low
    Wholesale Trade

Focus on What Matters

  1. See Everything.
  2. Identify True Risk.
  3. Proactively Mitigate Threats.

Let's talk!

background