Google has announced the release of Chrome 128 to the stable channel for Windows, Mac, and Linux.
This update, Chrome 128.0.6613.84 for Linux and 128.0.6613.84/.85 for Windows and Mac addresses a critical zero-day vulnerability actively exploited in the wild.
The update includes 38 security fixes, with particular attention to those contributed by external researchers.
The Chrome team has been working diligently to address a zero-day vulnerability that has been actively exploited.
The vulnerability, CVE-2024-7971, involves type confusion in V8, Chrome’s open-source JavaScript engine.
The Microsoft Threat Intelligence Center (MSTIC) and the Microsoft Security Response Center (MSRC) reported this flaw on August 19, 2024.
Are You From SOC/DFIR Teams? - Try Advanced Malware and Phishing Analysis With ANY.RUN -14-day free trial
While the specific details of the exploit remain restricted to protect users, the fix’s urgency underscores the vulnerability’s potential severity.
The Chrome team has emphasized that access to bug details and links will remain restricted until most users have updated their browsers.
This precaution ensures that users are protected before the vulnerability details are public, preventing further exploitation.
In addition to the zero-day vulnerability, the Chrome 128 update includes a wide range of security fixes.
Below is a table summarizing the key vulnerabilities addressed in this update:
| Bounty | CVE ID | Severity | Description | Reported On |
| $36,000 | CVE-2024-7964 | High | Use after free in Passwords | 2024-08-08 |
| $11,000 | CVE-2024-7965 | High | Inappropriate implementation in V8 | 2024-07-30 |
| $10,000 | CVE-2024-7966 | High | Inappropriate Implementation in Permissions | 2024-07-25 |
| $7,000 | CVE-2024-7967 | High | Heap buffer overflow in Fonts | 2024-07-27 |
| $1,000 | CVE-2024-7968 | High | Use after free in Autofill | 2024-06-25 |
| TBD | CVE-2024-7969 | High | Type Confusion in V8 | 2024-07-09 |
| TBD | CVE-2024-7971 | High | Type confusion in V8 | 2024-08-19 |
| $11,000 | CVE-2024-7972 | Medium | Inappropriate implementation in V8 | 2024-06-10 |
| $7,000 | CVE-2024-7973 | Medium | Heap buffer overflow in PDFium | 2024-06-06 |
| $3,000 | CVE-2024-7974 | Medium | Insufficient data validation in V8 API | 2024-05-07 |
| $3,000 | CVE-2024-7975 | Medium | Insufficient data validation in the Installer | 2024-06-16 |
| $2,000 | CVE-2024-7976 | Medium | Inappropriate implementation in FedCM | 2024-05-10 |
| $1,000 | CVE-2024-7977 | Medium | Insufficient Policy Enforcement in Data Transfer | 2024-02-11 |
| $1,000 | CVE-2024-7978 | Medium | Insufficient data validation in the Installer | 2022-07-21 |
| TBD | CVE-2024-7979 | Medium | Insufficient data validation in the Installer | 2024-07-29 |
| TBD | CVE-2024-7980 | Medium | Inappropriate Implementation in Views | 2024-07-30 |
| $1,000 | CVE-2024-7981 | Low | Inappropriate Implementation in WebApp Installs | 2023-07-14 |
| $500 | CVE-2024-8033 | Low | Inappropriate implementation in WebApp Installs | 2024-06-30 |
| $500 | CVE-2024-8034 | Low | Inappropriate implementation in Custom Tabs | 2024-07-18 |
| TBD | CVE-2024-8035 | Low | Inappropriate implementation in Extensions | 2022-04-26 |
The Chrome team is committed to ensuring user safety and has expressed gratitude to the security researchers who contributed to these fixes.
Users are strongly encouraged to update their browsers to the latest version to protect against these vulnerabilities.
Google also plans to release more information about new features and major efforts in upcoming blog posts for Chrome and Chromium.
As cyber threats evolve, timely updates and collaboration with the security community remain crucial in safeguarding users worldwide.
Protect Your Business with Cynet Managed All-in-One Cybersecurity Platform – Try Free Trial
Best DNS Management Tools play a crucial role in efficiently managing domain names and their…
Customers can now easily integrate Sweet’s runtime detection and response platform into their AWS environments…
Cybercriminals exploit leaked credentials, obtained through various means, to compromise systems and data, enabling them…
SpyAgent, a newly discovered Android malware, leverages OCR technology to extract cryptocurrency recovery phrases from…
In late October 2024, a coordinated IP spoofing attack targeted the Tor network, prompting abuse…
The Metasploit Framework, a widely used open-source penetration testing tool maintained by Rapid7, has introduced…