EXPOSURES › CVE-2024-5274
CVE-2024-5274
HIGH ⌖ ON CISA KEV · EXPLOITEDGoogle Chromium V8 Type Confusion Vulnerability allows remote code execution via crafted HTML pages.
This vulnerability enables remote attackers to execute arbitrary code through a crafted HTML page, posing a significant risk to DIB organizations relying on Chromium-based browsers for sensitive data. The active exploitation status and remote code execution capability make this a critical compliance concern for FedRAMP and NIST 800-171 environments. DIB orgs must immediately patch affected systems and audit browser configurations to mitigate exposure.
Shame score — While not a zero-day, the active exploitation status and widespread impact on Chromium-based browsers used in DIB environments create significant compliance and security risks.
▸ RECOMMENDED ACTION Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to execute code via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
| PRODUCT | STATUS |
|---|---|
| Google Services (Google Cloud Platform Products and underlying Infrastructure) Google |
Authorized |
| Google Workspace Google |
Authorized |