CVE-2024-12053 Memory corruption in Chrome

High 8.8 Published 3 Dec 2024 Updated 6 Dec 2024

A remote attacker can exploit object corruption in the V8 engine via a crafted HTML page, potentially leading to code execution.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2024-12053?

CVE-2024-12053 is a high-severity memory corruption vulnerability in Google Chrome, published on 3 Dec 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Type Confusion in V8 in Google Chrome prior to 131.0.6778.108 allowed a remote attacker to potentially exploit object corruption via a crafted HTML page. (Chromium security severity: High)

Weakness: CWE-843

Which versions are affected by CVE-2024-12053?

It affects 1 product.

Linux distribution packages (5)

`chromium` SUSE:Package Hub 15 SP5	All versions	`131.0.6778.108-bp155.2.147.1`
`chromium` SUSE:Package Hub 15 SP6	All versions	`131.0.6778.108-bp156.2.59.1`
`chromium` openSUSE:Leap 15.5	All versions	`131.0.6778.108-bp155.2.147.1`
`chromium` openSUSE:Leap 15.6	All versions	`131.0.6778.108-bp156.2.59.1`
`chromium` openSUSE:Tumbleweed	All versions	`131.0.6778.108-1.1`

Products include Google Chrome.

How do I fix CVE-2024-12053?

Upgrade to a fixed version.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2024-12053 being exploited?

There is no known exploitation of CVE-2024-12053 in the wild and no public exploit code.

All Google Chrome vulnerabilities

Sources

Also known as DEBIAN-CVE-2024-12053, DSA-5824-1, GHSA-wvx7-72hc-rp32, openSUSE-SU-2024:0405-1, openSUSE-SU-2024:0406-1, openSUSE-SU-2024:14552-1.