Lucene search

K
zdiEdouard Bochin (@le_douds) and Tao Yan (@Ga1ois)ZDI-24-367
HistoryApr 15, 2024 - 12:00 a.m.

(Pwn2Own) Google Chrome V8 Enum Cache Out-Of-Bounds Read Remote Code Execution Vulnerability

2024-04-1500:00:00
Edouard Bochin (@le_douds) and Tao Yan (@Ga1ois)
www.zerodayinitiative.com
23
google chrome
v8
enum cache
out-of-bounds read
remote code execution
user interaction
lack of validation
low integrity context

7.1 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

40.9%

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Google Chrome. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the implementation of the enum cache in V8. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process at low integrity.