Critical Vulnerabilities in Google Chrome Allow Remote Code Execution

Google has released a crucial update for its Chrome browser, addressing several high-severity vulnerabilities. These vulnerabilities could enable attackers to gain unauthorized access to memory and execute other harmful exploits.

The Stable channel of Chrome has been updated to version 131.0.6778.204/.205 for Windows and macOS and version 131.0.6778.204 for Linux. This update is expected to roll out to all users in the coming days and weeks.

Chrome Vulnerabilities

  1. CVE-2024-12692: A Type Confusion issue in the V8 JavaScript engine, identified by Seunghyun Lee (@0x10n) on December 5, 2024. This vulnerability could lead to heap corruption through a specially crafted HTML page.
  2. CVE-2024-12693: An Out-of-Bounds Memory Access vulnerability in the V8 engine, discovered by a researcher known as “303f06e3” on December 4, 2024. This flaw allows attackers to access restricted memory areas, posing serious security risks.
  3. CVE-2024-12694: A Use After Free vulnerability in the Compositing component, reported anonymously on September 19, 2024. This issue may cause unexpected behaviors or crashes by accessing memory after it has been freed.
  4. CVE-2024-12695: Another critical Out-of-Bounds Write vulnerability in the V8 engine, identified by “303f06e3” on December 12, 2024.

Google has intentionally withheld detailed information about these vulnerabilities to prevent their exploitation until most users have updated their browsers.

In addition to contributions from external researchers, Google’s internal security teams have addressed numerous vulnerabilities identified through audits and advanced tools like AddressSanitizer and MemorySanitizer. These efforts are aimed at proactively mitigating potential exploits.

Importance of Updating Chrome

Given the severity of these vulnerabilities, users are strongly advised to update their Chrome browsers immediately. Delaying updates could leave systems exposed to attacks exploiting these flaws.

How to Update Chrome:

  1. Open Chrome.
  2. Click the three-dot menu in the top-right corner.
  3. Navigate to “Help” > “About Google Chrome.”
  4. Chrome will automatically check for updates and install the latest version.
  5. Restart the browser to apply the changes.

Google has expressed its gratitude to all external researchers who contributed to identifying these vulnerabilities and emphasized its commitment to rewarding such efforts through its Bug Bounty program.

This update highlights the importance of regularly updating software to minimize risks associated with increasingly sophisticated cyber threats targeting widely used platforms like Chrome.

Skip to content