CVE-2024-7971: Google Chrome V8 type confusion enables heap corruption

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityConfirmed in-the-wild exploitation (KEV, nation-state attribution) with a critical CVSS of 9.6 and a widely deployed browser target.

What it is

Chrome's V8 JavaScript engine contains a type confusion flaw (CWE-843) that lets a crafted HTML page corrupt the heap. It affects Chrome before 128.0.6613.84 and, per the vendor list, Microsoft Edge. Because it is a browser engine bug reachable from web content, it is a serious remote code execution risk.

Impact

An attacker who gets a victim to load a malicious page can corrupt heap memory in the renderer, which can lead to code execution in the browser's sandboxed process and, combined with a sandbox escape, full compromise.

Attack surface

Reached over the network by a crafted HTML page rendered in Chrome or Edge; no authentication is required, but the victim must visit or be directed to the page (UI:R).

Exploitation

Listed in CISA KEV since 2024-08-26 with a 2024-09-16 remediation due date, and a Microsoft advisory ties exploitation to the North Korean actor Citrine Sleet. EPSS 30-day probability is about 20.7% (97th percentile), so exploitation is confirmed and active.

What to do

• Update Chrome to 128.0.6613.84 or later and Edge to its corresponding patched build immediately.
• Enforce browser auto-update and verify versions across managed endpoints.
• Prioritize patching internet-facing and high-value users per the KEV due date of 2024-09-16.
• If patching is not possible, restrict or discontinue use of the affected browser per vendor and CISA guidance.
• Review and tighten browser isolation or sandboxing controls for users who must browse untrusted content.

Detection

• Hunt for Chrome or Edge processes spawning unexpected child processes or making anomalous network connections after web browsing.
• Monitor for crashes in the renderer or V8-related crash signatures on endpoints running unpatched browser versions.
• Check asset inventories for Chrome versions below 128.0.6613.84 and Edge builds lacking the corresponding fix.
• Correlate proxy or DNS logs for known Citrine Sleet infrastructure and exploit delivery patterns.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.