CVE-2024-7971

Type confusion in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Score

CVSS 3.1 9.6 Critical

Status

Analyzed - chrome-cve-admin@google.com

Published

2024-08-21

Last modified

2025-10-21

Known exploited (CISA KEV)

since 2024-08-26, action due 2024-09-16: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Weaknesses

CWE-843

Affected products

• Chrome (Google)
• Edge (Microsoft)

References

• https://chromereleases.googleblog.com/2024/08/stable-channel-update-for-desktop_21.html
• https://issues.chromium.org/issues/360700873
• https://www.microsoft.com/en-us/security/blog/2024/08/30/north-korean-threat-actor-citrine-sleet-exploiting-chromium-ze…
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-7971