The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has recently added a high-severity vulnerability in Google Chromium’s V8 JavaScript engine, identified as CVE-2024-38856, to its Known Exploited Vulnerabilities (KEV) catalog. This vulnerability, with a CVSS score of 8.8, is classified as an inappropriate implementation issue that could potentially allow attackers to exploit the flaw and compromise affected systems. The V8 JavaScript engine, a core component of the Chromium browser, processes JavaScript code, making this vulnerability particularly concerning for users of Google Chrome and other Chromium-based browsers.
In response to this critical issue, Google has rolled out a security update designed to address CVE-2024-38856, alongside another zero-day vulnerability, CVE-2024-7965. This second flaw is actively being exploited in the wild, further highlighting the urgency of the updates. The new versions, 128.0.6613.84 and 128.0.6613.85, have been released for Windows, macOS, and Linux platforms. Google has begun rolling out these updates to all users in the Stable Desktop channel and plans to complete the distribution over the coming weeks to ensure widespread protection against these vulnerabilities.
CISA’s decision to include CVE-2024-38856 in the KEV catalog underscores the seriousness of the threat and the need for swift remediation. According to Binding Operational Directive (BOD) 22-01, federal agencies are required to address vulnerabilities listed in the KEV catalog by specific deadlines to protect their networks from potential exploitation. CISA has mandated that federal agencies resolve this particular vulnerability by September 18, 2024. This directive aims to ensure that federal systems are secured against known threats, reducing the risk of compromise.
Private organizations are also advised to take action by reviewing the KEV catalog and addressing any relevant vulnerabilities within their infrastructure. Staying proactive by applying the latest security updates and patches is crucial for mitigating the risks posed by such critical flaws. By adhering to these recommendations, both federal and private entities can enhance their cybersecurity posture, protect sensitive information, and safeguard against potential attacks that exploit these high-severity vulnerabilities.
Reference:
