{"id":"CVE-2024-7971","published":"2024-08-21T21:15:09Z","modified":"2026-06-17T08:21:35Z","title":"Google Chromium V8 Type Confusion Vulnerability","vendor":"Google","product":"Chromium V8","tier":"core","eol":null,"description":{"text":"Type confusion in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","provenance":"source","from":"NVD"},"summary":{"text":"A type confusion flaw in the V8 JavaScript engine of Google Chromium (Google Chrome, prior to 128.0.6613.84) lets V8 handle an object as an incompatible type. Remote attackers can exploit the resulting heap corruption by getting a victim to load a crafted HTML page, requiring no authentication but user interaction to visit the page.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-30T13:36:33Z"},"cvss":{"score":9.6,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.21009,"percentile":0.97563,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2024-08-26","dueDate":"2024-09-16","ransomware":false,"requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://chromereleases.googleblog.com/2024/08/stable-channel-update-for-desktop_21.html; https://nvd.nist.gov/vuln/detail/CVE-2024-7971","provenance":"source"},"vulncheckKev":{"dateAdded":"2024-08-21","exploitedFirstSeen":"2024-08-21","ransomware":false,"evidence":[{"url":"https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit","date":"2024-08-21"},{"url":"https://chromereleases.googleblog.com/2024/08/stable-channel-update-for-desktop_21.html","date":"2024-08-26"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2024-08-26"},{"url":"https://www.microsoft.com/en-us/security/blog/2024/08/30/north-korean-threat-actor-citrine-sleet-exploiting-chromium-zero-day/","date":"2024-08-30"},{"url":"https://www.gendigital.com/blog/news/innovation/lazarus-fudmodule-v3","date":"2024-09-19"},{"url":"https://www.cyfirma.com/research/apt-quarterly-highlights-q3-2024/","date":"2024-10-25"},{"url":"https://global.ptsecurity.com/analytics/cybersecurity-threatscape-2024-q3","date":"2024-11-19"},{"url":"https://www.gendigital.com/blog/insights/reports/threat-report-q3-2024","date":"2024-11-19"},{"url":"https://360.net/research/report/#:~:text=PDF-,Download,-Ransomware%20Prevalence%20Report","date":"2025-02-11"},{"url":"https://ti.qianxin.com/uploads/2025/02/21/5c66fbda0feb2714c53f54dcedcd2e43.pdf","date":"2025-02-21"}],"evidenceTotal":15,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"}],"provenance":"machine"},"cwes":[{"id":"CWE-843","name":"Access of Resource Using Incompatible Type"}],"references":[{"url":"https://chromereleases.googleblog.com/2024/08/stable-channel-update-for-desktop_21.html","tags":["Release Notes"]},{"url":"https://issues.chromium.org/issues/360700873","tags":["Permissions Required"]},{"url":"https://www.microsoft.com/en-us/security/blog/2024/08/30/north-korean-threat-actor-citrine-sleet-exploiting-chromium-zero-day/","tags":["Exploit","Patch","Third Party Advisory","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-7971","tags":["US Government Resource"]}],"techniques":[{"id":"T1189","name":"Drive-by Compromise","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Crafted HTML page drives browser exploitation","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"Type confusion in V8 in Google Chrome prior to 128.0.6613.84","start":0,"end":60}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1203","name":"Exploitation for Client Execution","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Heap corruption enables client-side code execution","mappingType":"primary_impact","evidence":[{"from":"description","quote":"allowed a remote attacker to exploit heap corruption","start":61,"end":113}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2024-48804","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-48804","exploited":true,"exploitedSince":"2024-08-26","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":1,"skipped":0,"earliest":"2025-04-12","earliestUrl":"https://github.com/mistymntncop/CVE-2024-7971","repos":[{"name":"mistymntncop/CVE-2024-7971","url":"https://github.com/mistymntncop/CVE-2024-7971","stars":37,"created":"2025-04-12"}]},"first":{"date":"2025-04-12","source":"PoC-in-GitHub","url":"https://github.com/mistymntncop/CVE-2024-7971"},"provenance":"source"},"exploitRefs":["https://www.microsoft.com/en-us/security/blog/2024/08/30/north-korean-threat-actor-citrine-sleet-exploiting-chromium-zero-day/"],"flow":[{"stage":"exploitation","techniques":["T1189"],"provenance":"ai"},{"stage":"primary","techniques":["T1203"],"provenance":"ai"}],"timeline":[{"date":"2024-08-21","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-7971","provenance":"source"},{"date":"2024-08-21","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit","provenance":"source"},{"date":"2024-08-26","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2024-08-26","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-48804","provenance":"source"},{"date":"2025-04-12","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/mistymntncop/CVE-2024-7971","provenance":"source"}],"speed":{"daysToPublicExploit":234,"firstExploitFrom":"PoC-in-GitHub","daysToKev":5},"priority":{"score":69.2,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 800 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.51,"detail":"percentile 0.9756"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 1 PoC-in-GitHub repo"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.72,"detail":"base score 9.6"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-class-google-chrome-cwe-843"}}