PT-2024-5817 · Google+5 · V8 Javascript Engine+6

Published 2024-08-21 · Updated 2026-04-05 · CVE-2024-7971

Positive Technologies · (AI Summary)

CVSS v3.1

10

Critical

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

The vulnerable software is Google Chrome, specifically the V8 JavaScript engine. The vulnerability is a type confusion issue that can be exploited to execute arbitrary code on affected systems.

The vulnerable versions are prior to 128.0.6613.84.

To exploit this vulnerability, an attacker can use a crafted HTML page to corrupt the heap and execute malicious code.

It is recommended to update Google Chrome to the latest version, 128.0.6613.84 or later, to patch this vulnerability.

North Korean hackers, known as Citrine Sleet, have been exploiting this vulnerability to deploy the FudModule rootkit and steal cryptocurrency.

#GoogleChrome #V8JavaScriptEngine #TypeConfusionVulnerability #RemoteCodeExecution #CyberSecurity #ZeroDayExploit #ChromeUpdate #PatchNow #CyberAttack #InfoSec #VulnerabilityManagement #Exploit #CVE

Exploit

Fix

Type Confusion

Weakness Enumeration

CWE-843

Related Identifiers

ALT-PU-2024-14994

ALT-PU-2024-14996

ALT-PU-2024-15041

ALT-PU-2024-15575

ALT-PU-2024-17740

ALT-PU-2025-2945

ALT-PU-2025-4366

ALT-PU-2025-7539

ALT-PU-2025-8547

BDU:2024-06562

CVE-2024-7971

DSA-5757-1

MGASA-2024-0321

OPENSUSE-SU-2024:0258-1

OPENSUSE-SU-2024:0258-2

OPENSUSE-SU-2024:0275-1

OPENSUSE-SU-2024:14285-1

OPENSUSE-SU-2024:14548-1

OPENSUSE-SU-2024_0275-1

Affected Products

Alt Linux

Astra Linux

Debian

Google Chrome

Red Os

Suse

V8 Javascript Engine

References · 366

• 🔥 https://microsoft.com/en-us/security/blog/2024/08/30/north-korean-threat-actor-citrine-sleet-exploiting-chromium-zero-day · Exploit
• https://osv.dev/vulnerability/openSUSE-SU-2024:0275-1 · Vendor Advisory
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-7971 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5757-1 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20251225SE16 · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/711745 · Security Note
• https://chromereleases.googleblog.com/2024/08/stable-channel-update-for-desktop_21.html · Security Note
• https://osv.dev/vulnerability/CVE-2024-7971 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-7971 · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/711125 · Security Note
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2024-1108SE17MD · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-7971 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:0258-2 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:14285-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2024-0321.html · Security Note