CVE-2024-7965
HIGH KEVGoogle Chrome < 128.0.6613.84 - Remote Code Execution via V8 Heap Corruption
Title source: llmExploitation Summary
CVE-2024-7965 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added August 28, 2024. EIP tracks 2 public exploits from researchers including bi-zone, XueDugu.
AI-analyzed exploit summary This PoC exploits a vulnerability in V8 on ARM64 devices, leveraging type confusion and out-of-bounds array access to achieve memory corruption. The code manipulates array indices and values to trigger the vulnerability, likely leading to arbitrary memory read/write.
Description
Inappropriate implementation in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Exploits (2)
This PoC exploits a vulnerability in V8 on ARM64 devices, leveraging type confusion and out-of-bounds array access to achieve memory corruption. The code manipulates array indices and values to trigger the vulnerability, likely leading to arbitrary memory read/write.
This PoC demonstrates a heap memory corruption vulnerability in Google Chrome's V8 JavaScript engine (CVE-2024-7965) on ARM64 devices. It manipulates array bounds and uses specific input conditions to trigger the vulnerability, potentially leading to arbitrary code execution.
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H