CVE-2024-4947

The type confusion error (CWE-843) occurs when the V8 engine improperly handles data types during JavaScript code execution — an object of one type is treated as an object of another type, leading to uncontrolled memory operations. An attacker can construct a specially crafted HTML page whose visit by the victim in Chrome browser triggers the vulnerability. The exploit works over the network (AV:N), requires only user interaction in the form of visiting a malicious page (UI:R), and requires no privileges (PR:N). Code execution takes place inside the browser sandbox, however the exploitation itself is highly effective due to the scope of impact (S:C — scope change).

An attacker can execute arbitrary code in the context of Chrome's rendering process, potentially gaining full control over the browser session contents, including access to sensitive data and the ability to further attack the system. The impact on confidentiality, integrity, and availability is assessed as high (C:H/I:H/A:H).

Google Chrome must be immediately updated to version 125.0.6422.60 or later. Fedora users should apply patches available in the distribution repositories according to announcements published on Fedora package lists. It is also recommended to enable automatic browser updates.

Google Chrome versions earlier than 125.0.6422.60 and Chromium packages in Fedora distributions (Fedora Linux — specified releases according to Fedora package lists).

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to execute code via a crafted HTML page.