Security Advisory for IT/DevOps Teams: Immediately audit and update all managed instances of Google Chrome and other Chromium-based browsers to address a critical, actively exploited zero-day vulnerability. Delaying this patch leaves systems open to potential remote code execution.
Google has released an emergency update for Chrome, addressing a high-severity zero-day flaw confirmed to be under active attack. Tracked as CVE-2024-6775, the vulnerability is a heap buffer overflow within Chrome's V8 JavaScript engine. This marks the seventh actively exploited zero-day patched in Chrome since the start of the year, highlighting a persistent and aggressive threat landscape in 2024.
A remote attacker could potentially execute arbitrary code on a victim's machine by tricking them into visiting a malicious webpage. The flaw's location in the V8 engine—the component that executes untrusted JavaScript from the web—makes this a direct and severe remote code execution vector.
The fix has been deployed in Chrome versions 126.0.6478.182 and 126.0.6478.183 for Windows, macOS, and Linux. This update patches a total of 230 vulnerabilities, with CVE-2024-6775 being the most critical due to its confirmed exploitation. Users and administrators are advised to restart the browser to trigger the automatic update or manually check via the "About Google Chrome" page.
This incident reinforces that browser zero-days are now a near-monthly occurrence, invalidating traditional, manual patching cycles. For IT teams, it underscores the necessity of enforced automatic updates and rapid patch management. A single unpatched endpoint remains a viable entry point for attackers.
The update also carries ecosystem-wide implications. Other major browsers built on the open-source Chromium project, such as Microsoft Edge, Brave, and Opera, share core components with Chrome. Security teams should anticipate that vendors will need to integrate corresponding fixes, extending the shared responsibility for security across the supply chain.
Recommended Actions: 1. Audit Immediately: Identify all endpoints where Google Chrome is installed. 2. Enforce Update: Ensure automatic browser updates are enabled. Manually trigger updates or deploy version 126.0.6478.182/183 or later via enterprise management tools. 3. Monitor Ecosystem: Plan for expedited updates to other Chromium-based browsers as vendors release their patches. 4. Verify: Confirm the patched version is running across all systems to eliminate this attack vector.
致IT/DevOps團隊的資安公告： 請立即審計並更新所有管理的Google Chrome及其他基於Chromium的瀏覽器實例，以應對一個已被積極利用的嚴重零日漏洞。延遲此修補將使系統面臨潛在的遠端編碼執行風險。
Google已為Chrome發布緊急更新，修補一個經證實正被積極攻擊的高嚴重性零日漏洞。此漏洞編號為CVE-2024-6775，存在於Chrome的V8 JavaScript引擎中，屬於堆疊緩衝區溢出問題。這是自今年初以來Chrome修補的第七個被積極利用的零日漏洞，凸顯了2024年持續且嚴峻的威脅態勢。
遠端攻擊者可能透過誘騙受害者訪問惡意網頁，在其裝置上執行任意編碼。由於漏洞位於執行網頁中不受信任的JavaScript的V8引擎內，這構成了一個直接且嚴重的遠端編碼執行向量。
修補程式已部署於適用於Windows、macOS和Linux的Chrome版本126.0.6478.182及126.0.6478.183。此次更新共修補230個漏洞，其中CVE-2024-6775因已被證實遭利用而成為最關鍵的漏洞。建議用戶及管理員重新啟動瀏覽器以觸發自動更新，或透過「關於Google Chrome」頁面手動檢查。
此次事件再次證實，瀏覽器零日漏洞現已近乎每月發生，使傳統的手動修補週期失去效用。對IT團隊而言，這突顯了強制執行自動更新及快速修補管理的必要性。單一未修補的端點仍是攻擊者可行的入侵點。
此次更新對整個生態系統亦有影響。其他基於開源Chromium project構建的主要瀏覽器（如Microsoft Edge、Brave及Opera）與Chrome共享核心元件。資安團隊應預期供應商需要整合相應的修補，將共同的安全責任擴展至整個供應鏈。
建議採取行動： 1. 立即審計： 識別所有安裝了Google Chrome的端點。 2. 強制更新： 確保啟用瀏覽器自動更新。手動觸發更新或透過企業管理工具部署版本126.0.6478.182/183或更高版本。 3. 監控生態系統： 在供應商發布其修補程式時，規劃對其他基於Chromium的瀏覽器進行緊急更新。 4. 驗證： 確認所有系統皆運行已修補版本，以消除此攻擊向量。