●Google Chrome 보안 · 2024년 5월

Google Chrome 보안 권고: V8 JIT 및 WebRTC

실제 공격에 악용된 V8 JIT 컴파일러 타입 혼동 취약점을 해결한 Chrome 긴급 안정화 채널 업데이트 분석.

1
Active Zero-Day (V8)
8.8
CVSS Severity
Critical
Browser Exploitation
Immediate
Fleet Patch Urgency

보안 릴리스 분석 및 위험성 평가

Google has released an emergency security update for Chrome across Windows, Mac, and Linux to patch CVE-2024-4947, an actively exploited type confusion vulnerability in the V8 JavaScript engine. This flaw allows malicious web pages to escape the V8 sandbox and execute arbitrary code in the browser renderer process.

핵심 취약점 트리아지 매트릭스

CVE 식별자 서브시스템 / 구성 요소 영향 CVSS 실제 악용 여부?
CVE-2024-4947V8 JavaScript EngineJIT Type Confusion8.8 HighYES (In-The-Wild)
CVE-2024-4948Dawn / WebGPUUse-After-Free8.1 HighNo
CVE-2024-4949V8 WebAssemblyOut-of-Bounds Memory Access7.5 HighNo
CVE-2024-4950Downloads SubsystemInappropriate Implementation4.3 MediumNo
FEATURED CODE TEARDOWN

Deep Dive: CVE-2024-4947 Chrome V8 Turbofan Type Confusion Teardown →

Examine the exact C++ Git commit from Chromium Gerrit showing how property accessor prototype transitions fooled the Turbofan optimizer.

← Browse Full Security Directory Explore All Source Teardowns →