CVE-2024-7971
Google Chromium V8 Type Confusion Vulnerability
Description
CVE-2024-7971 is a critical type confusion vulnerability (CVSS 9.6) in Google Chrome's V8 JavaScript engine, allowing remote attackers to exploit heap corruption through a crafted HTML page. Affecting Chrome versions prior to 128.0.6613.84 and Microsoft Edge versions prior to 128.0.2739.42, this vulnerability has been attributed to exploitation by North Korean threat actor Citrine Sleet. It has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog with confirmed active exploitation in the wild. The EPSS score of 1.49% (80.8th percentile) places it above the exploitation probability of most CVEs, though its confirmed nation-state exploitation makes it far more dangerous than the score alone suggests.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| chrome | < 128.0.6613.84 | |
| microsoft | edge | < 128.0.2739.42 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://chromereleases.googleblog.com/2024/08/stable-channel-update-for-desktop_21.html(Release Notes)
- https://issues.chromium.org/issues/360700873(Permissions Required)
- https://www.microsoft.com/en-us/security/blog/2024/08/30/north-korean-threat-actor-citrine-sleet-exploiting-chromium-zero-day/(Exploit, Patch, Third Party Advisory, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-7971(US Government Resource)
Weakness Type
Type Confusion in V8
Type confusion is a memory corruption vulnerability that occurs when a program accesses a resource using a type that is incompatible with the actual type of that resource. In the V8 JavaScript engine, type confusion vulnerabilities arise when the engine incorrectly assumes the type of a JavaScript object during JIT compilation or runtime optimization. When V8 operates on an object as if it were a different type, it may read or write memory at incorrect offsets, leading to heap corruption. This class of vulnerability is especially dangerous in browser engines because it can be triggered by JavaScript code served from any web page, and successful exploitation typically provides the attacker with arbitrary code execution capabilities within the browser's renderer process.
Impact Analysis
The CVSS score of 9.6 (Critical) reflects the exceptional severity of this vulnerability, with the Changed scope metric amplifying its impact beyond the vulnerable component. Confidentiality impact is rated High, as exploitation grants attackers the ability to read arbitrary data from the browser process, including session cookies, authentication tokens, and content from other origins. Integrity impact is also High, enabling arbitrary code execution that can modify browser data, inject malicious content, or install persistent threats. Availability impact is High, with exploitation capable of crashing the browser or rendering it fully compromised.
The Changed scope designation is particularly significant — it means that a successful exploit in the V8 engine can impact resources beyond the component's own security boundary, potentially affecting the host operating system if combined with a sandbox escape. Microsoft's threat intelligence team attributed exploitation of this vulnerability to the North Korean threat actor Citrine Sleet, who targeted victims in the cryptocurrency sector. This nation-state attribution elevates the threat model significantly, as it demonstrates that sophisticated adversaries are actively weaponizing this flaw. The EPSS score of 1.49% (80.8th percentile) may appear moderate, but the confirmed exploitation by an advanced persistent threat group means organizations should treat this as an emergency. The ransomware association is unknown, though the cryptocurrency theft motive suggests financial exploitation is the primary objective.
Exploit Maturity
CVE-2024-7971 has been confirmed as actively exploited in the wild and is listed in CISA's Known Exploited Vulnerabilities catalog with a remediation deadline of September 16, 2024. Microsoft published a detailed threat intelligence report attributing the exploitation to Citrine Sleet, a North Korean threat actor group known for targeting the cryptocurrency industry. The exploit was used as a zero-day before Google's patch was available, demonstrating sophisticated offensive capabilities. The EPSS score of 1.49% (80.8th percentile) reflects the exploitation probability among the broader CVE landscape, but the confirmed nation-state usage means the real-world risk is substantially higher. Public exploit information is available through Microsoft's advisory, which provides detailed analysis of the attack chain. While the ransomware association is listed as unknown, the threat actor's focus on cryptocurrency theft represents a different but equally damaging form of financial exploitation.
Remediation
-
Update Google Chrome immediately — Upgrade to Chrome version 128.0.6613.84 or later. Navigate to Settings > About Chrome to trigger the update. Restart the browser after the update is applied to ensure the fix takes effect.
-
Update Microsoft Edge — Upgrade to Edge version 128.0.2739.42 or later. For enterprise deployments, use Microsoft Intune, WSUS, or Configuration Manager to deploy the update across your fleet.
-
Prioritize patching for cryptocurrency and financial sector users — Given the attribution to Citrine Sleet targeting the cryptocurrency industry, organizations in the financial and cryptocurrency sectors should treat this as the highest priority and accelerate their patching timeline.
-
Implement browser isolation — Deploy remote browser isolation solutions to contain potential exploits before patches can be rolled out. This is especially important for users who interact with untrusted web content or receive links from unknown sources.
-
Monitor for indicators of compromise — Review Microsoft's threat intelligence report on Citrine Sleet for specific indicators of compromise, including command-and-control infrastructure and post-exploitation techniques. Integrate these IOCs into your security monitoring tools and investigate any matches in historical logs.
Technical Details
The CVSS v3.1 vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H shows a critical vulnerability profile. Attack Vector (Network) indicates remote exploitation over the internet. Attack Complexity (Low) means no specialized conditions are required. Privileges Required (None) confirms no authentication is needed. User Interaction (Required) means a victim must visit a malicious page, though this is trivially achievable through phishing. The critical distinction from similar V8 vulnerabilities is the Scope (Changed) metric, indicating that exploitation can impact resources beyond the vulnerable component's security authority — this is what elevates the CVSS from 8.8 to 9.6.
The technical root cause is a type confusion bug in V8's handling of JavaScript objects. V8's optimizing JIT compiler (TurboFan) makes assumptions about object types during compilation to generate fast machine code. When a type confusion occurs, V8 treats a JavaScript object as a different type than it actually is, causing the generated code to read or write memory at incorrect offsets relative to the object's actual structure. This leads to heap corruption, where an attacker can carefully craft a sequence of JavaScript operations to manipulate the corrupted heap state into achieving arbitrary memory read and write capabilities. From there, the attacker can overwrite function pointers or other control flow data to hijack execution and run arbitrary shellcode. The Citrine Sleet threat actor used this vulnerability as part of a multi-stage exploit chain targeting cryptocurrency organizations, combining it with additional techniques to escape the Chrome sandbox and achieve full system compromise.
Frequently Asked Questions
What is CVE-2024-7971?
CVE-2024-7971 is a critical type confusion vulnerability in Google Chrome's V8 JavaScript engine with a CVSS score of 9.6. It allows remote attackers to exploit heap corruption by convincing a user to visit a crafted HTML page. The vulnerability was exploited as a zero-day by the North Korean threat actor Citrine Sleet.
Who is exploiting CVE-2024-7971?
Microsoft's threat intelligence team attributed the exploitation to Citrine Sleet, a North Korean threat actor group that primarily targets the cryptocurrency industry for financial gain. The group used this vulnerability as part of a sophisticated attack chain to compromise victims in the crypto sector.
How does CVE-2024-7971 differ from CVE-2024-7965?
Both vulnerabilities affect Chrome's V8 engine and were patched in the same update (128.0.6613.84), but they have different root causes. CVE-2024-7971 is a type confusion bug with a higher CVSS score of 9.6 due to its Changed scope, while CVE-2024-7965 is an inappropriate implementation issue rated 8.8. CVE-2024-7971 has confirmed nation-state exploitation attribution.
What should I do to protect against CVE-2024-7971?
Update Chrome to version 128.0.6613.84 or later and Edge to version 128.0.2739.42 or later immediately. Organizations in the cryptocurrency and financial sectors should treat this as an emergency. Implement browser isolation and review Microsoft's threat intelligence report on Citrine Sleet for specific indicators of compromise.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.