Google Discovers Fourth Zero-Day in Less Than a Month
Google has released an update from its Chrome team for a high-severity security flaw, tracked as CVE-2024-5274, that actively exists in the wild.
The bug is classified as critical and is a type confusion vulnerability in the V8 JavaScript and WebAssembly engine.
These type confusion vulnerabilities, also known as type manipulation, can occur when a threat actor modifies a variable in order to trigger an unintended action. This can enable a threat actor to cause a crush, execute arbitrary code, or access control bypasses, among other capabilities.
The vulnerability was reported by two researchers: Google Threat Analysis Group’s Clément Lecigne and Chrome Security’s Brendon Tiszka.
This is the fourth zero-day vulnerability that Google has had to patch this month alone. The other vulnerabilities include CVE-2024-4947, CVE-2024-4761, and CVE-2024-4671.
Google recommends that Windows and macOS users upgrade to Chrome version 125.0.6422.112/.113 and Linux users to version 125.0.6422.112. Chromium-based users should apply fixes as they become available, Google added.
