Wiz
Vulnerability DatabaseCVE-2024-4947

CVE-2024-4947: 
vulnerability analysis and mitigation

Overview

CVE-2024-4947 is a type confusion vulnerability discovered in the V8 JavaScript engine of Google Chrome versions prior to 125.0.6422.60. The vulnerability was reported by Kaspersky researchers Vasily Berdnikov and Boris Larin on May 13, 2024, and was classified as High severity. This security flaw affects Chrome browsers across Windows, Mac, and Linux operating systems (Chrome Blog, NVD).

Technical details

The vulnerability is categorized as a type confusion bug in Chrome's V8 JavaScript and WebAssembly engine. Type confusion vulnerabilities occur when a program attempts to access a resource using an incompatible type, which can lead to out-of-bounds memory access and potential code execution. The issue has been assigned a CVSS score of 8.8, indicating its critical nature (Hacker News).

Impact

The vulnerability allows a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. This type of vulnerability can potentially lead to program crashes and arbitrary code execution within the browser's sandbox environment (NVD).

Mitigation and workarounds

Google has released Chrome version 125.0.6422.60/.61 for Windows and macOS, and version 125.0.6422.60 for Linux to address this vulnerability. Users of Chromium-based browsers such as Microsoft Edge, Brave, Opera, and Vivaldi are advised to apply the fixes as they become available (Hacker News).

Additional resources

Source: This report was generated using AI

Free Vulnerability Assessment

Benchmark your Cloud Security Posture

Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.

Request assessment

Additional Wiz resources

Cloud Vulnerability DB

Cloud Vulnerability DB

An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues

Cloud threat landscape

Cloud threat landscape

A comprehensive threat intelligence database of cloud security incidents, actors, tools and techniques

PEACH

PEACH

A step-by-step framework for modeling and improving SaaS and PaaS tenant isolation

Get a personalized demo

Ready to see Wiz in action?

“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management
Get a demo