CVE-2024-7971

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 128.0.6613.84 Microsoft Edge (affected versions not specified) Opera versions prior to 113.0.5230.32 Chromium versions prior to 128.0.6613.84

Description A type confusion issue exists in the V8 JavaScript and WebAssembly engine. This flaw allows a remote attacker to exploit heap corruption—a condition where memory allocation in the heap is corrupted—via a specially crafted HTML page. Successful exploitation can lead to arbitrary read/write access to the JavaScript heap, potentially enabling remote code execution (RCE) within the Chromium rendering sandbox, sandbox escape, and full endpoint compromise. This issue was exploited as a zero-day by a North Korean threat actor known as Citrine Sleet (also known as AppleJeus, Labyrinth Chollima, UNC4736, and Hidden Cobra) to target individuals and financial institutions in the cryptocurrency sector for financial gain.

Recommendations Update Google Chrome to version 128.0.6613.84 or later. Update Chromium to version 128.0.6613.84 or later. Update Opera to version 113.0.5230.32 or later. Update Microsoft Edge to the latest version provided by the vendor.