CVE-2024-4761
Google Chromium V8 Out-of-Bounds Memory Write Vulnerability
Description
CVE-2024-4761 is a high-severity out-of-bounds write vulnerability in the V8 JavaScript engine of Google Chrome that allows a remote attacker to perform an out-of-bounds memory write through a crafted HTML page. With a CVSS v3.1 base score of 8.8, this vulnerability affects Chrome versions prior to 124.0.6367.207 and was actively exploited as a zero-day before the patch was released. CISA has added CVE-2024-4761 to the Known Exploited Vulnerabilities catalog with a remediation deadline of June 6, 2024, and the ransomware association is currently unknown. Its EPSS score of 5.59% at the 90.1st percentile reflects significant exploitation probability, consistent with confirmed zero-day exploitation targeting Chrome's JavaScript engine.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| chrome | < 124.0.6367.207 | |
| fedoraproject | fedora | 38; 39; 40 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
References
- https://chromereleases.googleblog.com/2024/05/stable-channel-update-for-desktop_13.html(Vendor Advisory)
- https://issues.chromium.org/issues/339458194(Permissions Required)
- https://lists.fedoraproject.org/archives/list/[email protected]/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/(Mailing List)
- https://lists.fedoraproject.org/archives/list/[email protected]/message/NTSN22LNYXMWHVTYNOYQVOY7VDZFHENQ/(Mailing List)
- https://lists.fedoraproject.org/archives/list/[email protected]/message/WSUWM73ZCXTN62AT2REYQDD5ZKPFMDZD/(Mailing List)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-4761(US Government Resource)
Weakness Type
Out-of-Bounds Write in V8 JavaScript Engine
CVE-2024-4761 is an out-of-bounds write vulnerability in Chrome's V8 JavaScript engine. Out-of-bounds writes occur when a program writes data past the end of an allocated buffer or before its beginning, corrupting adjacent memory. In V8, out-of-bounds write vulnerabilities typically arise from errors in array bounds checking, buffer management, or JIT-compiled code that incorrectly calculates memory offsets. An attacker can craft JavaScript code that triggers V8 to write beyond the boundaries of an allocated buffer, enabling them to corrupt adjacent objects in memory and potentially achieve arbitrary code execution within the renderer process. Out-of-bounds writes in V8 are among the most dangerous vulnerability classes because they provide a direct primitive for memory corruption without requiring complex exploitation chains. Learn more about out-of-bounds writes at CWE-787.
Impact Analysis
The impact of CVE-2024-4761 is severe, with the CVSS vector reflecting high impact across all three security dimensions. Confidentiality is fully compromised because the out-of-bounds write can be leveraged to achieve arbitrary memory reads within the renderer process, exposing authentication cookies, session tokens, form data, page contents, and sensitive information from the victim's browsing context.
Integrity faces maximum impact as arbitrary code execution within the renderer process allows the attacker to modify page content, intercept and alter web requests, inject malicious scripts, and forge actions on behalf of the victim across authenticated web applications.
Availability is completely at risk since the memory corruption can crash the renderer process or be used to establish persistent malicious code execution that degrades browser functionality. The network attack vector (AV:N), low complexity (AC:L), no privileges required (PR:N), and only requiring user interaction (UI:R) in the form of visiting a web page make this vulnerability suitable for drive-by download attacks and targeted phishing campaigns. The EPSS score of 5.59% at the 90.1st percentile confirms active exploitation. CVE-2024-4761 was part of an unprecedented cluster of Chrome V8 zero-days exploited during May 2024, alongside CVE-2024-4947 and CVE-2024-5274, indicating sustained targeting of the V8 engine by sophisticated threat actors.
Exploit Maturity
CVE-2024-4761 has confirmed active zero-day exploitation, with Google acknowledging in-the-wild exploitation at the time the patch was released. CISA has included it in the Known Exploited Vulnerabilities catalog with a remediation deadline of June 6, 2024, the earliest deadline among the May 2024 Chrome zero-days. The EPSS score of 5.59% at the 90.1st percentile confirms significant exploitation probability.
The vulnerability was disclosed in the Chrome stable channel update on May 13, 2024, where Google confirmed awareness of an exploit existing in the wild. The associated Chromium bug tracker entry has restricted access, indicating that full technical details are being withheld to allow users time to update. CVE-2024-4761 was the first of three V8 zero-days patched in rapid succession during May 2024, followed by CVE-2024-4947 on May 15 and CVE-2024-5274 on May 23.
The ransomware association remains unknown. Like other V8 zero-days, CVE-2024-4761 is more likely associated with targeted espionage and surveillance operations given the sophistication required to develop reliable V8 exploitation techniques. The concentration of three V8 zero-days in a single month suggests either a single well-resourced threat actor or a period of intense competitive discovery of V8 vulnerabilities.
Remediation
-
Update Google Chrome to version 124.0.6367.207 or later immediately. Open Chrome, navigate to Settings > About Chrome, and ensure the browser updates. Enterprise administrators should push this update as an emergency security deployment, prioritizing it above other patch management activities.
-
Update all Chromium-based browsers. Microsoft Edge, Brave, Opera, Vivaldi, and other Chromium-based browsers share the V8 engine and are affected by this vulnerability. Coordinate with all browser vendors' update channels to ensure comprehensive patching across the organization.
-
Verify automatic update policies are enforced. Review Chrome enterprise policies to ensure automatic updates are not blocked or delayed. For this class of actively exploited zero-day, any delay in patch deployment increases exposure. Set Chrome update policies to apply critical security updates without administrative delay.
-
Deploy URL filtering and threat intelligence. Configure web proxies and security gateways with threat intelligence feeds that identify and block domains associated with V8 exploitation campaigns. Network-level protections provide defense-in-depth while browser patches are being rolled out across the organization.
-
Review browser crash reports for exploitation indicators. Audit Chrome crash reports across the organization for patterns that may indicate exploitation attempts. V8 out-of-bounds write exploits may generate distinctive crash signatures before successful exploitation is achieved. Correlate any anomalous crash patterns with user activity and email analysis to identify potential targeted attacks.
Technical Details
CVE-2024-4761 is an out-of-bounds write vulnerability in the V8 JavaScript engine with a CVSS v3.1 vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, resulting in a high base score of 8.8. The network attack vector (AV:N) enables remote exploitation when a victim visits a malicious web page. The low attack complexity (AC:L) indicates reliable exploitation, and no authentication is required (PR:N). The only prerequisite is user interaction (UI:R) in the form of navigating to the attacker-controlled page.
The out-of-bounds write exists within V8's handling of JavaScript operations that involve memory buffer manipulation. V8 performs extensive optimizations during JIT compilation, including bounds check elimination where the compiler determines that array accesses are provably within bounds. If this analysis is incorrect — due to a bug in the compiler's range analysis or type inference — the generated machine code may omit necessary bounds checks, allowing writes to memory locations outside the allocated buffer.
When an attacker triggers the out-of-bounds write, they can corrupt adjacent heap objects within the V8 heap. By carefully controlling what data is written and where, the attacker can overwrite object pointers, vtable entries, or other critical metadata to redirect execution flow or create arbitrary read/write primitives. Unlike type confusion vulnerabilities that require manipulating V8's type system, out-of-bounds writes provide a more direct memory corruption primitive. The scope is unchanged (S:U), with the impact contained within the renderer process, but the full compromise of confidentiality (C:H), integrity (I:H), and availability (A:H) means complete control within the sandboxed process. Chrome versions prior to 124.0.6367.207 are affected, along with Fedora 38, 39, and 40 distributions.
Frequently Asked Questions
What is CVE-2024-4761?
CVE-2024-4761 is a high-severity out-of-bounds write vulnerability in Chrome's V8 JavaScript engine that allows a remote attacker to corrupt memory and potentially execute code within the browser sandbox by tricking a victim into visiting a malicious web page. It has a CVSS v3.1 score of 8.8 and was exploited as a zero-day.
How does CVE-2024-4761 differ from the other May 2024 Chrome zero-days?
CVE-2024-4761 is an out-of-bounds write vulnerability, while CVE-2024-4947 and CVE-2024-5274 are type confusion vulnerabilities. All three affect V8 and were exploited as zero-days, but they target different aspects of the engine. CVE-2024-4761 involves incorrect bounds checking leading to memory corruption, while the other two involve type system inconsistencies.
Are other Chromium-based browsers affected by CVE-2024-4761?
Yes. All browsers built on the Chromium engine that use V8 are affected, including Microsoft Edge, Brave, Opera, and Vivaldi. Each browser vendor releases their own updates incorporating the V8 fix, and all should be updated promptly.
Why were there three Chrome V8 zero-days in one month?
The concentration of three V8 zero-days in May 2024 is unusual and suggests intense exploitation activity targeting the V8 engine. This could indicate a single sophisticated threat actor with multiple V8 exploits, competitive discovery by multiple groups, or the exploitation of related underlying weaknesses in V8's codebase that were discovered in close succession.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.