CVE-2024-7971
Google Chromium V8 — Google Chromium V8 Type Confusion Vulnerability
Description
Response & Mitigation
Why act now?
Prioritisation rationale
CVE-2024-7971 carries a CVSS v3 score of 9.6 with a Changed scope, meaning a successful exploit can break out of the browser sandbox and fully compromise the underlying host (C:H/I:H/A:H). The EPSS score sits at the 97.4th percentile, indicating a very high likelihood of active exploitation relative to all published CVEs. The attack requires no authentication and only a single user interaction — visiting a crafted page — making drive-by delivery via phishing links or malicious ad networks the primary vector. Organisations with large, heterogeneous endpoint fleets and without enforced browser update policies are most exposed. The CISA KEV entry does not carry the known-ransomware-campaign flag, which slightly lowers the immediate ransomware risk compared to other KEV entries, but the full-host compromise potential makes this critical for any NIS2-scoped organisation and warrants patch deployment within the first 24-hour window.
Runbook · Step 1
Immediate response (0-24 h)
- Apply the patch now: Update Google Chrome to version 128.0.6613.84 or 128.0.6613.85 — both releases contain the fix. Also update Microsoft Edge and Opera (Chromium-based) to their latest available versions; consult each vendor's advisory for exact build numbers.
- Enforce browser updates across the managed fleet: Trigger forced updates via GPO/Intune/JAMF immediately and pull a compliance report within 4 hours to identify unpatched endpoints.
- Isolate high-risk endpoints: Disconnect privileged-access workstations (PAWs), admin workstations, and KRITIS/OT-adjacent machines from general internet browsing until patch deployment is confirmed.
- Disable or restrict JavaScript: On systems that cannot be patched immediately, disable JavaScript or restrict it to an allowlist using Chrome policy
DefaultJavaScriptSetting = 2. - Verify EDR coverage: Confirm that EDR agents are active on all endpoints and are configured to capture process-ancestry chains originating from browser processes.
Runbook · Step 2
Mitigation layers
- Network segmentation: Route all outbound HTTP/HTTPS traffic (ports 80/443) from KRITIS segments and OT-adjacent networks through a dedicated proxy with TLS inspection; block direct browser-to-internet connections.
- Web proxy and DNS filtering: Block categories such as "Newly Registered Domains" and "Malware/Phishing" at the proxy gateway; enable DNS sinkholing for known exploit-kit infrastructure.
- Endpoint exploit protection: Enforce DEP, forced ASLR, and CFG for
chrome.exeandmsedge.exevia Windows Defender Exploit Guard. On Linux/macOS, audit browser launch parameters and prohibit the--no-sandboxflag via policy. - Least-privilege for browser processes: Ensure browsers do not run with elevated privileges; use AppLocker/WDAC rules to prevent new executables from being launched out of
%TEMP%or%APPDATA%by browser child processes. - IPS signatures: Review your Suricata/Snort ruleset for Chromium V8 heap-corruption exploit signatures (ET category
exploit.browser); check vendor threat-intelligence feeds for CVE-2024-7971-specific SIDs. - Email gateway URL rewriting: Rewrite or defang URLs pointing to newly registered or uncategorised domains in HTML emails to reduce the drive-by delivery surface via phishing links.
Runbook · Step 3
Detection rules
- EDR — process ancestry: Alert when
chrome.exeormsedge.exespawns unexpected child processes such ascmd.exe,powershell.exe,wscript.exe, ormshta.exe. Sigma shape:ParentImage|endswith: 'chrome.exe'ANDImage|endswith: '\cmd.exe'. - Sysmon EID 1 / EID 10: Monitor for process-injection attempts originating from a renderer process (
chrome.exe --type=renderer) targeting non-browser processes — EID 10 (ProcessAccess) whereSourceImagematches the renderer andTargetImageis outside the browser's own process tree. - Windows Event Log — AppLocker/WDAC EID 8004/8007: Blocked execution attempts from browser temporary directories (
\AppData\Local\Temp,\AppData\Local\Google\Chrome\). - Network telemetry (Zeek/Suricata): Outbound connections initiated by the browser process to non-standard ports (not 80/443) or to IP addresses without a preceding DNS resolution immediately after a page load — KQL shape:
DeviceNetworkEvents | where InitiatingProcessFileName =~ "chrome.exe" and RemotePort !in (80, 443). - Web proxy logs: Browser-initiated downloads of executable content (Content-Type
application/octet-stream,.exe,.dll) from domains registered fewer than 30 days ago, correlated with the originating browser session.
Metrics
Weakness classes (CWE)
CWE-843Base
Access of Resource Using Incompatible Type ('Type Confusion')
The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.
cwe.mitre.org →
Affected products
Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.
Google
Chrome< 128.0.6613.84
fixed in 128.0.6613.84
Google
Chrome< 128.0.6613.85
fixed in 128.0.6613.85
Public exploit references
Public proof-of-concepts and detection templates for this vulnerability. Maturity ranges from reported PoCs through working detection scripts up to fully weaponized exploit modules. NEOSEC mirrors the code internally for forensic analysis; externally we only link to the original sources.
References & sources
- https://chromereleases.googleblog.com/2024/08/stable-channel-update-for-desktop_21.html
- https://issues.chromium.org/issues/360700873
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-7971government-resource
- https://www.microsoft.com/en-us/security/blog/2024/08/30/north-korean-threat-actor-citrine-sleet-exploiting-chromium-zero-day/