CVE-2024-4059 - Out of Bounds Read in V8 API Exposed User Data in Chrome Before Version 124

CVE-2024-4059 is a high-severity security vulnerability that was discovered in the V8 JavaScript engine, which is used by Google Chrome and other Chromium-based browsers. The bug allowed remote attackers to exploit a memory out-of-bounds read through crafted HTML pages. This means attackers could leak sensitive cross-site data, violating the very principles of web browser security.

Google patched this vulnerability in Chrome version 124..6367.78. If you’re using an older version, you are exposed to potential data leaks.

Official advisory:
- Google Chrome Stable Channel Update
- Chromium CVE-2024-4059 bug entry

What Is an Out of Bounds Read?

An out-of-bounds (OOB) read occurs when a program reads memory outside the bounds of an allocated buffer. In the context of V8 (Chrome’s JS engine), such a bug may allow scripts to read information belonging to other origins or even leak browser memory structures.

V8 processes JavaScript code and manages various objects including arrays and typed arrays in memory. A flaw in those mechanisms could allow a script to access memory that’s not meant to be visible, leaking information from other tabs (cross-site data).

How The Attack Works

For CVE-2024-4059, the attacker needs to create a specially-crafted HTML page (with JavaScript). When a victim opens this page in an unpatched Chrome browser, the malicious script triggers the OOB vulnerability to read nearby memory. If successful, the attacker extracts data that could belong to a different website (cross-origin), such as personally identifiable info, tokens, cookies, or browsing activity.

This kind of bug is dangerous for privacy and web security: browsers are supposed to isolate content of different web pages (origins) from each other.

Simple Proof-of-Concept (PoC) Code

While the official bug report remains private, similar OOB bugs in V8 often leverage TypedArrays, Arrays, or Objects with length manipulation tricks. Here is an illustrative PoC based on typical V8 exploitation trends (for educational purposes only; this will NOT work on patched Chrome):

// WARNING: This is only an illustration, does not exploit Chrome 124+
let arr = [1.1, 2.2, 3.3];
let floatArray = new Float64Array(10);

function triggerOOB() {
  // Simulate a bug that would corrupt arr's length
  arr.length = 100;  // Normally NOT possible, but let's imagine a bug allows it

  for (let i = ; i < arr.length; i++) {
    try { 
      // Reading out-of-bounds values; might leak memory content
      console.log(arr[i]);
    } catch (e) {
      // Ignore exceptions
    }
  }
}

triggerOOB();

NOTE: In real-world attacks, the bug is triggered using more complicated engine internals, and attackers would look for secret data in the spilled memory.

Cross-Site Reading: Bypasses Chrome’s security features, such as Same-Origin Policy.

- High Severity: Google’s security team rated this as “High” because of the potential for abuse and privacy loss.

Fix and Solution

WHAT TO DO:

Update Google Chrome to version 124..6367.78 or later ASAP!

- Chromium-based browsers (Edge, Brave, Opera, etc.) should also publish updates incorporating the patch.

Check your Chrome version:
Go to “Help” → “About Google Chrome” to see if you are on a safe release.

Final Thoughts

Browser vulnerabilities like CVE-2024-4059 show why updating your software is critical. Attackers constantly scan for victims running old browser versions to steal data with zero interaction.

Stay safe:
Keep Chrome and all your browsers up to date. Enable auto-updates wherever possible.

If you have security needs or manage a group of devices, consider enforcing browser update policies to patch bugs like this promptly.

*Written exclusively for you—share this long read if you found it helpful!*

Timeline

Published on: 05/01/2024 13:15:52 UTC
Last modified on: 12/19/2024 18:56:45 UTC