Google on Thursday rolled out a fresh Chrome update to address another exploited vulnerability in the popular web browser, the fourth zero-day to be patched in two weeks.
Tracked as CVE-2024-5274, the high-severity flaw is described as a type confusion in the V8 JavaScript and WebAssembly engine.
“Google is aware that an exploit for CVE-2024-5274 exists in the wild,” the internet giant noted in an advisory.
The company shared no details on the bug itself, nor on the in-the-wild exploitation, but credited Clement Lecigne of Google’s Threat Analysis Group (TAG) and Brendon Tiszka of Chrome Security for reporting the flaw. No bug bounty reward will be handed out for the discovery.
Chrome vulnerabilities are often exploited by commercial surveillance software vendors and Google TAG researchers previously reported several zero-days targeted by spyware vendors, including security defects in Google’s browser.
CVE-2024-5274 is the fourth to be patched within the past 15 days, after Google squashed CVE-2024-4671 (use-after-free in Visuals), CVE-2024-4761 (out-of-bounds write in V8), and CVE-2024-4947 (type confusion in V8).
Google has resolved a total of eight Chrome zero-days so far this year, with three of them, namely CVE-2024-2886, CVE-2024-2887, and CVE-2024-3159, demonstrated at the Pwn2Own Vancouver 2024 hacking contest in March.
The latest Chrome iteration is now rolling out as version 125.0.6422.112 for Linux and as versions 125.0.6422.112/.113 for Windows and macOS. Google also announced the release of Chrome for Android versions 125.0.6422.112/.113 with the same security fixes.
Users are advised to update to the latest Chrome releases as soon as possible.
