CVE-2024-5274

The type confusion error (CWE-843) in the V8 engine involves the JavaScript engine incorrectly interpreting the type of an object in memory, treating it as a different type than it actually is. An attacker can craft an HTML page containing appropriate JavaScript code that forces this incorrect interpretation. As a result, it is possible to execute arbitrary code in the context of the browser rendering process, even with the sandbox mechanism active.

An attacker can execute arbitrary code (RCE) within the browser sandbox, which may lead to violations of confidentiality, integrity, and availability of data processed by the browser. Combined with a separate vulnerability enabling sandbox escape, it is possible to take control of the victim's system.

Google Chrome should be updated to version 125.0.6422.112 or newer. Fedora users should apply package updates published by the Fedora Project according to references. It is also recommended to enable automatic browser updates.

Google Chrome in versions earlier than 125.0.6422.112 and Google Chrome packages available in Fedora Linux distributions (according to Fedora Project package lists).

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to execute code via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.