Flash Notice: Google Memory Corruption Zero-Day Exploited by Attackers

overview

This week, Google patched a high-severity zero-day vulnerability (CVE-2024-0519) actively exploited in Chrome. This memory corruption bug involves out-of-bounds memory access in Chrome's V8 JavaScript engine. Exploitation can lead to unauthorized memory access, system crashes, data modification, or malicious code injection. 

For those unaware, V8 stands as an open-source JavaScript and WebAssembly engine, crafted by the Chromium Project for Chromium and Google Chrome web browsers. CVE-2024-0519 could allow a remote attacker to exploit heap corruption through a carefully crafted HTML page.  

The Chrome team acknowledges reports confirming the existence of an exploit for CVE-2024-0519 in the wild. However, access to technical details for the vulnerability are kept restricted until “a majority of users are updated with a fix.” 

Because Microsoft Edge is built on Chromium, Microsoft is currently working on a security patch for it. They want to point out that Microsoft Edge has an enhanced security mode that helps deal with this vulnerability. If you enable this security feature, you can be confident that Microsoft Edge will protect you from CVE-2024-0519. 

avertium's recommendationS

• Google Chrome has patched CVE-2024-0519, as addressed in their advisory. If you have set your browser to update automatically then you don’t need to do anything 
• If you do not receive automatic updates and patch manually, you should apply the patch as soon as possible. To update Chrome:  
  • Open Chrome 
  • Top right > More  
  • Click Help > About Google Chrome 
  • Click Update Google Chrome (Can’t find this button? It means you are on the latest version)  
  • Click Relaunch 
• Find patch guidance for Microsoft Edge in their advisory.  

INDICATORS OF COMPROMISE (IoCs)

At this time, there are no known IoCs associated with CVE-2024-0519. Avertium remains vigilant in locating IoCs for our customers. Should any be located, Avertium will disclose them as soon as possible. For more information on how Avertium can help protect your organization, please reach out to your Avertium Service Delivery Manager or Account Executive.   

How Avertium is Protecting Our CUSTOMERS

• Expanding endpoints, cloud computing environments, and accelerated digital transformation have decimated the perimeter in an ever-expanding attack surface. Avertium offers Attack Surface Management, so you’ll have no more blind spots, weak links, or fire drills. See every threat in your attack surface, every device, every entry point, and every vulnerability. Our Attack Surface Management services include:  
  • Risk Assessments 
  • Pen Testing and Social Engineering  
  • Infrastructure Architecture and Integration  
  • Zero Trust Network Architecture 
  • Vulnerability Management 
• Fusion MXDR is the first MDR offering that fuse together all aspects of security operations into a living, breathing, threat-resistant XDR solution. By fusing insights from threat intelligence, security assessments, and vulnerability management into our MDR approach, Fusion MXDR offers a more informed, robust, and cost-effective approach to cybersecurity – one that is greater than the sum of its parts. 
• We highly value your feedback. Kindly spare a moment to complete our feedback form, allowing us to enhance our services for our valued customers. 

SUPPORTING DOCUMENTATION