# CVE-2024-7971

CVE-2024-7971 is a critical-severity vulnerability rated 9.6/10 on the CVSS scale. Type confusion in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to exploit heap corruption via a crafted HTML page. (Chromium security severity: High). CISA has confirmed active exploitation in the wild. EPSS estimates a 19.27% chance of exploitation in the next 30 days.

## Description

Type confusion in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

## Metrics

- **CVSS:** 3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
- **CVSS Score:** 9.6/10
- **EPSS Probability:** 19.27%  (97.0th percentile)

Probability of exploitation in the next 30 days. [Learn more](https://www.first.org/epss/)

## Exploitation Status

This vulnerability is listed in CISA’s [Known Exploited Vulnerabilities](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) catalog, confirming active exploitation in the wild. Federal agencies must remediate by Sep 16, 2024.

## Weakness Enumeration

- [CWE-843](https://cwe.mitre.org/data/definitions/843.html)

## Affected Software

| Vendor    | Product | Versions               |
|-----------|---------|------------------------|
| Google    | Chrome  | < 128.0.6613.84       |
| Microsoft | Edge    | < 128.0.2739.42       |

## References

- [Release Notes](https://chromereleases.googleblog.com/2024/08/stable-channel-update-for-desktop_21.html)
- [Permissions Required](https://issues.chromium.org/issues/360700873)
- [Exploit, Patch, Third Party Advisory, Vendor Advisory](https://www.microsoft.com/en-us/security/blog/2024/08/30/north-korean-threat-actor-citrine-sleet-exploiting-chromium-zero-day/)
- [US Government Resource](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-7971)

## Timeline

- **Published:** Aug 21, 2024  
- **Last Modified:** Jun 17, 2026  
- **Status:** Analyzed

## Frequently Asked Questions

### What is CVE-2024-7971?

### How severe is CVE-2024-7971?

CVE-2024-7971 has a CVSS score of 9.6/10 (CRITICAL severity). The EPSS model estimates a 19.27% probability of exploitation in the next 30 days. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog.

### How do I fix CVE-2024-7971?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also [run a Strix scan](https://app.strix.ai/) to test if your systems are affected.