CVE-2024-4947

CRITICAL KEV

Google Chrome < 125.0.6422.60 - Remote Code Execution via V8 Type Confusion

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2024-4947 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added May 20, 2024. EIP tracks 1 public exploit from researchers including bjrjk.

AI-analyzed exploit summary This repository contains a functional exploit PoC for CVE-2024-4947, a V8 type confusion vulnerability. It demonstrates the 'Object Hash Reassign' exploit pattern, achieving arbitrary memory read/write via corrupted JSArray length manipulation.

Description

Type Confusion in V8 in Google Chrome prior to 125.0.6422.60 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

Exploits (1)

nomisec WORKING POC 29 stars
by bjrjk · client-side
https://github.com/bjrjk/CVE-2024-4947

This repository contains a functional exploit PoC for CVE-2024-4947, a V8 type confusion vulnerability. It demonstrates the 'Object Hash Reassign' exploit pattern, achieving arbitrary memory read/write via corrupted JSArray length manipulation.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Complex
Reliability
Reliable
Target: V8 JavaScript Engine (Chromium 12.4.254.16)
No auth needed
Prerequisites: V8 engine with Maglev optimization enabled · Ability to execute JavaScript in target environment
devstral-2 · analyzed Feb 18, 2026 Full analysis →

References (6)

Core 6

Scores

CVSS v3 9.6
EPSS 0.1511
EPSS Percentile 96.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation active
Automatable no
Technical Impact total

Details

CISA KEV 2024-05-20
VulnCheck KEV 2024-05-13
InTheWild.io 2024-05-13
ENISA EUVD EUVD-2024-44509
CWE
CWE-843
Status published
Products (4)
fedoraproject/fedora 38
fedoraproject/fedora 39
fedoraproject/fedora 40
google/chrome < 125.0.6422.60
Published May 15, 2024
KEV Added May 20, 2024
Tracked Since Feb 18, 2026