CVE-2024-4947
Google Chromium V8 Type Confusion Vulnerability
Description
CVE-2024-4947 is a critical type confusion vulnerability in the V8 JavaScript engine of Google Chrome that allows a remote attacker to execute arbitrary code inside the browser sandbox through a crafted HTML page. With a CVSS v3.1 base score of 9.6, this vulnerability affects Chrome versions prior to 125.0.6422.60 and was actively exploited as a zero-day before Google released a patch. CISA has added CVE-2024-4947 to the Known Exploited Vulnerabilities catalog with a remediation deadline of June 10, 2024, and the ransomware association is currently unknown. Its EPSS score of 0.37% at the 58.3rd percentile is relatively modest compared to the severity, likely reflecting the targeted nature of the zero-day exploitation rather than broad automated campaigns.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| chrome | < 125.0.6422.60 | |
| fedoraproject | fedora | 38; 39; 40 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
References
- https://chromereleases.googleblog.com/2024/05/stable-channel-update-for-desktop_15.html(Vendor Advisory)
- https://issues.chromium.org/issues/340221135(Exploit, Issue Tracking)
- https://lists.fedoraproject.org/archives/list/[email protected]/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/(Mailing List)
- https://lists.fedoraproject.org/archives/list/[email protected]/message/NTSN22LNYXMWHVTYNOYQVOY7VDZFHENQ/(Mailing List)
- https://lists.fedoraproject.org/archives/list/[email protected]/message/WSUWM73ZCXTN62AT2REYQDD5ZKPFMDZD/(Mailing List)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-4947(US Government Resource)
Weakness Type
Type Confusion in V8 JavaScript Engine
CVE-2024-4947 is a type confusion vulnerability in Chrome's V8 JavaScript engine, the same engine that powers all Chromium-based browsers. Type confusion occurs when a program incorrectly casts or interprets an object as a different type than it actually is, leading to memory corruption and potential code execution. In V8, type confusion vulnerabilities arise from errors in the engine's type inference, JIT compilation optimizations, or object representation handling. An attacker can craft JavaScript code that causes V8 to misinterpret the type of an object, enabling them to read and write arbitrary memory locations within the renderer process. V8 type confusion has been one of the most frequently exploited vulnerability classes in Chrome zero-day attacks. Learn more about type confusion at CWE-843.
Impact Analysis
The impact of CVE-2024-4947 is critical, with the CVSS vector reflecting maximum severity across all impact dimensions with a changed scope. Confidentiality is fully compromised because arbitrary code execution within the renderer process grants the attacker access to all data in the browsing context, including authentication cookies, form data, page contents, and potentially data from other sites if site isolation protections can be circumvented. The changed scope (S:C) indicates that the V8 type confusion impacts resources beyond the V8 engine itself, affecting the entire renderer process.
Integrity faces maximum impact as the attacker gains the ability to execute arbitrary code within the sandbox, enabling modification of page content, interception of user credentials, injection of malicious scripts, and manipulation of web application behavior. The attacker can forge requests to authenticated services on behalf of the victim.
Availability is completely at risk since the attacker can crash the renderer process or establish persistent code execution that degrades browser performance. The network attack vector (AV:N), low complexity (AC:L), no privileges required (PR:N), and only requiring a user to visit a page (UI:R) make this vulnerability exploitable through standard web attack vectors. Google confirmed active exploitation as a zero-day, and the Chromium bug tracker entry is tagged as an exploit, confirming that a weaponized exploit was used in real attacks before the patch was available.
Exploit Maturity
CVE-2024-4947 has confirmed active zero-day exploitation, with Google acknowledging in-the-wild exploitation at the time of patch release. CISA has included it in the Known Exploited Vulnerabilities catalog with a remediation deadline of June 10, 2024. While the EPSS score of 0.37% at the 58.3rd percentile appears moderate, this is consistent with targeted zero-day attacks that have limited distribution compared to mass exploitation campaigns.
The vulnerability was disclosed in the Chrome stable channel update on May 15, 2024, where Google confirmed awareness of active exploitation. The associated Chromium bug tracker entry is tagged as an exploit. CVE-2024-4947 was one of three V8 type confusion zero-days exploited in Chrome during May 2024, alongside CVE-2024-4761 and CVE-2024-5274, suggesting a period of intense V8 exploitation activity potentially by sophisticated threat actors.
The ransomware association remains unknown. V8 type confusion zero-days are characteristically associated with nation-state surveillance operations and targeted espionage rather than financially motivated cybercrime. The targeted nature of the exploitation and the sophistication required to develop reliable V8 exploits indicate a well-resourced threat actor.
Remediation
-
Update Google Chrome to version 125.0.6422.60 or later immediately. Navigate to Chrome Settings > About Chrome to trigger an automatic update. Enterprise administrators should deploy the update as an emergency security patch through their browser management infrastructure.
-
Update all Chromium-based browsers across the organization. Microsoft Edge, Brave, Opera, Vivaldi, and all other Chromium-based browsers share the V8 engine and are affected. Ensure all browsers are updated to versions that incorporate the V8 fix.
-
Enable automatic Chrome updates and reduce update lag. Configure Chrome enterprise policies to minimize the delay between patch availability and deployment. For this class of actively exploited zero-day, updates should be applied within hours, not days. Consider enabling Chrome's auto-update mechanism without administrative delay.
-
Implement browser isolation for high-risk users. Deploy remote browser isolation (RBI) technology for users who are likely targets of sophisticated attacks, such as executives, security personnel, and employees handling sensitive data. Browser isolation executes web content in a disposable cloud environment, preventing local exploitation.
-
Monitor for indicators of targeted attack campaigns. Review security logs for signs of spear-phishing attempts that may have been used to deliver the exploit. Look for suspicious links in emails, unusual browser crashes, and network connections to unrecognized infrastructure that could indicate a targeted exploitation campaign.
Technical Details
CVE-2024-4947 is a type confusion vulnerability in the V8 JavaScript engine with a CVSS v3.1 vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, resulting in a critical base score of 9.6. The network attack vector (AV:N) enables remote exploitation when a victim visits a malicious web page. The low attack complexity (AC:L) indicates that the exploit works reliably, and no authentication is required (PR:N). The only prerequisite is user interaction (UI:R) in the form of navigating to the attacker-controlled page.
The type confusion exists within V8's internal type system, which tracks the types of JavaScript values for optimization during JIT compilation. V8 maintains type feedback information that it uses to generate optimized machine code. The vulnerability arises when specific JavaScript operations cause V8's type tracking to become inconsistent with the actual object types in memory. An attacker can construct a sequence of JavaScript operations that causes V8 to compile code that accesses an object through an incorrect type assumption, resulting in memory corruption.
This memory corruption can be leveraged to achieve arbitrary read and write primitives within the address space of the Chrome renderer process. The changed scope (S:C) reflects that the type confusion in V8 compromises the entire renderer process, not just the V8 engine component. From this compromised renderer, the attacker achieves full impact on confidentiality (C:H), integrity (I:H), and availability (A:H) within the sandboxed process. Chrome versions prior to 125.0.6422.60 are affected, along with Fedora 38, 39, and 40 distributions that package Chromium.
Frequently Asked Questions
What is CVE-2024-4947?
CVE-2024-4947 is a critical type confusion vulnerability in Chrome's V8 JavaScript engine that was exploited as a zero-day, allowing a remote attacker to execute arbitrary code within the browser sandbox by tricking a victim into visiting a malicious web page. It has a CVSS v3.1 score of 9.6.
Was CVE-2024-4947 exploited before a patch was available?
Yes. Google confirmed that CVE-2024-4947 was actively exploited in the wild before the patch was released in Chrome 125.0.6422.60 on May 15, 2024. This makes it a true zero-day vulnerability that was weaponized before defenders had a fix available.
How does CVE-2024-4947 relate to other Chrome zero-days in May 2024?
CVE-2024-4947 was one of three V8 type confusion zero-days exploited in Chrome during May 2024, alongside CVE-2024-4761 (out-of-bounds write) and CVE-2024-5274 (type confusion). This cluster of V8 zero-days suggests an intense period of exploitation activity targeting Chrome's JavaScript engine.
Does Chrome's sandbox protect against CVE-2024-4947?
Chrome's sandbox limits the impact of the vulnerability to the renderer process. However, within that sandbox, the attacker has full access to the browsing context's data and can perform actions on behalf of the user. A separate sandbox escape vulnerability would be needed for full system compromise, but the in-sandbox impact alone is significant.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.