Google patches 3rd Chrome browser zero-day inside of a week

Click for more special coverage

Security pros said the most important bug was the high-severity zero-day — CVE-2024-4947 — described by NIST as a type confusion in V8 in Google Chrome prior to 125.0.6422.60 that allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.

Google said CVE-2024-4947 was reported by Vasily Berdnikov and Boris Larin of Kaspersky on May 13. The company also noted that it's aware that an exploit for CVE-2024-4947 exists in the wild.

"More than any change with Chrome itself, [these zero-days] are a reflection of attackers continuing to focus on browsers in general and Chrome in particular as their most prized target," said Lionel Litty, chief security architect at Menlo Security. "An exploitable bug in Chrome often means the ability to target not only the vast numbers of Chrome users on desktop and Android, but also the users of Edge and other more niche browsers that are also based on Chromium."

Patrick Tiquet, vice president of security and architecture at Keeper Security, said that these high-security flaws are serious and teams should patch them immediately.  

"With CVE-2024-4947 actively being exploited in the wild, remote attackers can execute arbitrary code on affected systems, potentially compromising them entirely and allowing for data theft, system manipulation or further exploitation, making it critical for Chrome users to update their browsers as soon as possible," said Tiquet.  

Updated LightSpy spyware for macOS emerges

SC StaffMay 31, 2024

Cybernews reports that updates have been introduced to the LightSpy surveillance tool to expand its targeting to systems running on older iterations of macOS after initially only targeting iOS devices.

Get daily email updates

SC Media's daily must-read of the most current and pressing daily news