Google has released security updates to fix the first Chrome zero-day vulnerability exploited in the wild since the start of the year. "Google is aware of reports that an exploit for CVE-2024-0519 exists in the wild," the company said in a security advisory published Tuesday. The company fixed the zero-day for users in the Stable Desktop channel, with patched versions rolling out worldwide to Windows (120.0.6099.224/225), Mac (120.0.6099.234), and Linux (120.0.6099.224) users less than a week after being reported to Google. Although Google says the security update could take days or weeks to reach all impacted users, it was available immediately when BleepingComputer checked for updates today. Those who prefer not to update their web browser manually can rely on Chrome to automatically check for new updates and install them after the next launch.
The high-severity zero-day vulnerability (CVE-2024-0519) is due to a high-severity out-of-bounds memory access weakness in the Chrome V8 JavaScript engine, which attackers can exploit to gain access to data beyond the memory buffer, providing them access to sensitive information or triggering a crash. "The expected sentinel might not be located in the out-of-bounds memory, causing excessive data to be read, leading to a segmentation fault or a buffer overflow," MITRE explains. "The product may modify an index or perform pointer arithmetic that references a memory location that is outside of the boundaries of the buffer. A subseque...