[UPDATE] [high] Google Chrome: Multiple Vulnerabilities
Actively exploited. At least one CVE in this advisory is listed in the CISA Known Exploited Vulnerabilities catalog — exploitation has been observed in the wild. Treat remediation as urgent.
A remote, anonymous attacker can exploit multiple vulnerabilities in Google Chrome to execute arbitrary code, perform UI spoofing, bypass security mechanisms, and perform other unspecified attacks.
CSIRTS triage
- What
- Multiple vulnerabilities in Google Chrome enable arbitrary code execution, UI spoofing, and bypass of security mechanisms.
- Who is affected
- Users of Google Chrome across all platforms.
- Urgency
- Critical; actively exploited vulnerabilities in widely deployed browser.
- Action
- Update Google Chrome to the latest version immediately.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch Chrome
Get an email when a new Chrome advisory drops — max one per day, one-click unsubscribe.
Details
Original advisory: https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-1901
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Exploitation confirmedCVE-2024-7965Already exploited in the wild (CISA KEV) — the prediction phase is over. Patch now. Riskier than 97% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2024-79640.59% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 46% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2024-79660.67% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 49% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2024-79670.60% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 46% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2024-79680.57% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 45% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2024-79690.51% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 41% of all EPSS-scored CVEs.
- Exploitation confirmedCVE-2024-7971Already exploited in the wild (CISA KEV) — the prediction phase is over. Patch now. Riskier than 97% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2024-79720.58% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 45% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2024-79730.77% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 53% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2024-79740.49% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 40% of all EPSS-scored CVEs.
Referenced CVEs
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- criticalexploitedCVE-2024-7965: Google Chromium V8 Inappropriate Implementation Vulnerabilitycisa-kev
- criticalexploitedCVE-2024-7971: Google Chromium V8 Type Confusion Vulnerabilitycisa-kev
Recent advisories for Google Chrome
A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.
- unknownexploitedNCSC-2026-0354 [1.00] [M/H] Kwetsbaarheid verholpen in Google Chromencsc-nl · 2026-09-09
- high[NEU] [hoch] Google Chrome: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriffcert-bund · 2026-09-09
- high[UPDATE] [hoch] Google Chrome: Mehrere Schwachstellencert-bund · 2026-09-09
- highexploited[UPDATE] [hoch] Google Chrome / Microsoft Edge: Mehrere Schwachstellencert-bund · 2026-09-09
- mediumCVE-2026-87658: Information leak in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attack…nvd · 2026-09-09
- lowCVE-2026-87657: Use after free in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had…nvd · 2026-09-09
More from CERT-Bund (BSI) Security Advisories
- high[UPDATE] [hoch] Dell Secure Connect Gateway: Mehrere Schwachstellen2026-09-09
- medium[UPDATE] [mittel] Linux Kernel: Mehrere Schwachstellen ermöglichen Denial of Service2026-09-09
- medium[UPDATE] [mittel] Red Hat Enterprise Linux (dracut): Schwachstelle ermöglicht Ausführen von beliebigem Program…2026-09-09
- high[UPDATE] [hoch] Golang Go: Mehrere Schwachstellen2026-09-09
- medium[UPDATE] [mittel] Golang Go: Mehrere Schwachstellen2026-09-09