iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Google patched CVE-2024-7971, an exploited high-severity type-confusion flaw in Chrome’s V8 JavaScript engine, in Chrome 128 on August 21, 2024. Affected installations were below 128.0.6613.84, or below 128.0.6613.84/.85 on Windows and macOS. Users needed to update, relaunch Chrome, and verify the build; this is a historical 2024 incident, not a recommendation to run Chrome 128 today.
Key takeaways
- CVE-2024-7971 was a high-severity V8 type-confusion vulnerability that Google said was exploited in the wild.
- Google’s patched Chrome 128 builds were 128.0.6613.84 for Linux and 128.0.6613.84/.85 for Windows and macOS.
- NVD identifies Chrome versions before 128.0.6613.84 as affected and records the vulnerability in CISA’s Known Exploited Vulnerabilities catalog.
- The “sixth Chrome zero-day of 2024” label described Google’s tally as of August 21–22, 2024; it was not a severity ranking or a current Chrome security status.
- Updating Chrome was not enough for an organization using Edge, Opera, Brave, Vivaldi, or another Chromium-based browser; each product required its own vendor-specific update check.
What does “Google Patches Sixth Exploited Chrome Zero-Day of 2024” mean?
The headline refers to Google’s August 21, 2024 Chrome 128 stable-channel release, which fixed CVE-2024-7971, a type-confusion vulnerability in the V8 JavaScript engine. Google’s release notice identified CVE-2024-7971 as being exploited in the wild and credited Microsoft’s Threat Intelligence Center and Microsoft Security Response Center with reporting it on August 19, 2024. The contemporaneous SecurityWeek report described the fix as Google’s sixth exploited Chrome zero-day patch of 2024.
| # | Preview | Product | Price | |
|---|---|---|---|---|
| 1 |
|
Search+ For Google | Buy on Amazon | |
| 2 |
|
Google Search | Buy on Amazon | |
| 3 |
|
Search+ for Google | Buy on Amazon | |
| 4 |
|
Google Drive | Buy on Amazon |
The word “sixth” needs historical context. The count meant the sixth Chrome vulnerability exploited in attacks and patched by Google by August 21–22, 2024. The count did not mean CVE-2024-7971 was the sixth vulnerability discovered in 2024, and it was not a ranking of technical severity. The incident also does not mean Chrome is currently vulnerable in 2026; the relevant action today is to run a currently supported, fully updated browser rather than deliberately remain on Chrome 128.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What vulnerability did Chrome 128 fix?
Chrome 128 fixed CVE-2024-7971, a type-confusion flaw in V8. Type confusion occurs when software treats an object as a different type from the type the object actually has. In a JavaScript engine, that mismatch can make later operations use incorrect assumptions about an object’s layout or contents.
Popular on Amazon
- google search
- google map
- google plus
- youtube music
- youtube
The security consequence can include heap corruption and browser compromise. A crafted or compromised web page could provide the attack content, and NVD’s assessment indicates that user interaction was required, consistent with a victim opening or visiting malicious web content. The public record supports describing serious browser compromise as a possible consequence; it does not support claiming that every victim experienced data theft, malware installation, or complete operating-system takeover.
NVD categorizes CVE-2024-7971 as CWE-843 type confusion. Google classified the Chrome issue as High, while NVD’s later enriched record assigns it a 9.6 Critical score. Those labels come from different assessment contexts and should not be flattened into one universal rating.
Google’s initial public notice did not disclose exploit code, indicators of compromise, detailed exploit mechanics, or a full description of the campaign. An exploited browser vulnerability can also be only one part of a larger attack chain; additional vulnerabilities, sandbox escape techniques, social engineering, or user interaction may be necessary to reach a broader compromise.
Which Chrome versions were vulnerable?
The practical cutoff for CVE-2024-7971 was Chrome 128.0.6613.84. Google’s Chrome 128 stable-channel update notice listed the following fixed builds:
| Platform | Fixed build reported by Google | Action for an older installation |
|---|---|---|
| Linux | 128.0.6613.84 | Update and relaunch Chrome. |
| Windows | 128.0.6613.84 or 128.0.6613.85 | Update and relaunch Chrome. |
| macOS | 128.0.6613.84 or 128.0.6613.85 | Update and relaunch Chrome. |
NVD lists Chrome releases below 128.0.6613.84 as affected. The versions above are historical remediation thresholds for the August 2024 incident, not suitable long-term versions in 2026. Chrome users should install the current update offered by Google for their supported channel.
Was CVE-2024-7971 actively exploited?
Yes. Google said CVE-2024-7971 was being exploited in the wild when Google published the Chrome 128 security update. That statement establishes active exploitation, but it does not establish that every unpatched Chrome installation was attacked or compromised.
Also popular on Amazon
- Google search engine.
Microsoft later connected exploitation of the Chromium zero-day to Citrine Sleet, a North Korean threat actor, in a Microsoft Security threat-intelligence report published on August 30, 2024. The attribution is later Microsoft reporting, not an attacker identification included in Google’s original August 21 patch notice.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWhy was it called Chrome’s sixth zero-day of 2024?
CVE-2024-7971 was called the sixth Chrome zero-day of 2024 because it was the sixth Chrome vulnerability known to have been exploited in attacks and patched by Google by the time of the contemporaneous August 21–22 reporting. “Zero-day” in this context described exploitation before or around the time a broadly available fix was issued, not the sixth CVE number or the sixth bug discovered that year.
The tally later became more complicated. Google’s August release information was subsequently updated to say that CVE-2024-7965 was also being exploited in the wild. The later exploitation report came after the Chrome 128 release, so it should not automatically be treated as equivalent to CVE-2024-7971’s original zero-day status. Google’s August 2024 Chrome release archive provides the later release context.
What else did Chrome 128 fix?
Chrome 128 addressed 38 security vulnerabilities, according to the contemporaneous release coverage. SecurityWeek reported that the release included seven high-severity issues, nine medium-severity issues, and four low-severity issues, along with multiple memory-safety bugs such as use-after-free, out-of-bounds access, heap-buffer overflow, and additional V8 issues.
SecurityWeek also reported approximately $95,000 in bug-bounty payments announced for the release at publication time, including a reported $36,000 award for CVE-2024-7964. Some rewards remained undecided, so the total could have increased. The 38-bug total and the bounty figures do not mean that all Chrome 128 vulnerabilities were exploited. Google’s exploited-in-the-wild statement applied to CVE-2024-7971 and, in a later update, CVE-2024-7965.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →How do you update and verify Chrome?
Individual Chrome users could update the browser through Chrome’s About page:
Also popular on Amazon
- Voice search enabled
- Clean and simple to use
- Max speed and compatibility for your Kindle device
- Open Chrome.
- Enter
chrome://settings/helpin the address bar, or open the three-dot menu and choose Help followed by About Google Chrome. - Allow Chrome to check for and download available updates.
- Choose Relaunch when Chrome offers the button. Downloading an update is not the same as running the browser with the patched code active.
- Return to the About page and confirm that the installed version is at or above the applicable fixed build for the incident.
If Chrome reports that it is up to date but shows an old version, close every Chrome window and reopen the browser, then check the About page again. A background process, a pending restart, an offline device, enterprise policy, insufficient permissions, or a separately installed browser copy can prevent the expected update from becoming active.
What should enterprise administrators check?
Enterprise administrators should verify browser inventory and restart compliance rather than assume that automatic updates completed. The priority is to identify every affected browser process, install the vendor-approved security update, and confirm that the updated process actually restarted.
- Inventory every platform: Check Windows, macOS, and Linux separately, including Stable, Extended Stable, Beta, and Dev channels where those channels are deployed.
- Find overlooked installations: Include remote-desktop images, virtual desktops, kiosks, golden images, portable packages, and devices with more than one browser installation.
- Enforce completion: Use the organization’s endpoint or browser-management system to accelerate updates where policy allows, and track devices that downloaded an update but have not restarted.
- Prioritize exposure: Start with internet-facing systems, privileged users, administrators, developers, high-value users, and devices that handled untrusted web content during the exploitation window.
- Review telemetry: Examine web-proxy, endpoint, browser, and identity telemetry for suspicious visits or exploit activity around the period when affected builds were exposed.
- Update images: Patch the source image for VDI, kiosk, and managed desktop deployments so an old browser is not restored during the next rebuild or login.
Organizations that need centralized browser policy, reporting, and update governance can compare Chrome Enterprise Core with existing endpoint-management tools. Chrome Enterprise Premium is a separate browser-security offering; Google’s Chrome Enterprise plans page displayed a $6-per-user-per-month price for Premium on August 16, 2026. The right choice depends on inventory accuracy, update enforcement, restart compliance, policy control, reporting, and whether the organization must manage non-Chrome Chromium browsers as well.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsDid the vulnerability affect Microsoft Edge and other Chromium browsers?
Potentially, but Chrome’s patch did not automatically patch every Chromium-based browser. Chrome, Microsoft Edge, Opera, Brave, Vivaldi, and other products share upstream Chromium components, while each vendor packages, tests, and releases its own browser update.
NVD’s affected-configuration data lists Microsoft Edge versions below 128.0.2739.42 as affected. Edge administrators therefore needed to check Microsoft’s own release and installed version rather than infer protection from a Chrome update. The same principle applies to every other Chromium-derived browser: consult the vendor’s advisory and verify the product-specific fixed build.
What did CISA’s KEV listing require?
CISA added CVE-2024-7971 to its Known Exploited Vulnerabilities catalog on August 26, 2024, with a remediation deadline of September 16, 2024 for U.S. federal agencies. The NVD record and CISA KEV information made the exploitation status an important prioritization signal.
Also popular on Amazon
- Get access to files anywhere through secure cloud storage and file backup for your photos, videos, files and more with Google Drive.
The September 16 deadline was a federal-agency remediation requirement under the applicable U.S. government process. It was not a universal legal deadline for consumers or every private company. Private organizations could still reasonably use the KEV listing to prioritize emergency browser patching according to their own risk and compliance programs.
Recommended Free Tools
What should you do if the browser was unpatched during the attack window?
Update the browser first, then investigate according to the device’s risk and available telemetry. An unpatched browser is evidence of exposure, not proof that exploitation succeeded.
- Update and relaunch Chrome or the affected Chromium browser.
- Record the installed version, device identity, user, and approximate period during which the old build was active.
- Check proxy, DNS, endpoint, browser, identity, and EDR telemetry for unusual sites, downloads, child processes, credential access, or other suspicious activity.
- Escalate potentially compromised privileged or high-value devices for incident-response review rather than relying only on a browser reinstall.
- Update machine images, alternate browser installations, and other Chromium products so the old exposure is not reintroduced.
Do not infer a full operating-system compromise solely from the CVE. The public advisories do not provide enough detail to claim a particular payload, data theft event, or successful sandbox escape for every affected installation.
Incident timeline
| Date | Event |
|---|---|
| August 19, 2024 | Microsoft’s Threat Intelligence Center and Microsoft Security Response Center reported CVE-2024-7971 to Google. |
| August 21, 2024 | Google published the Chrome 128 stable-channel security update. |
| August 22, 2024 | SecurityWeek reported the fix as Google’s sixth exploited Chrome zero-day patch of 2024. |
| August 26, 2024 | CISA added CVE-2024-7971 to the Known Exploited Vulnerabilities catalog. |
| August 30, 2024 | Microsoft published later threat-intelligence reporting connecting exploitation to Citrine Sleet. |
| September 16, 2024 | CISA’s listed remediation deadline for U.S. federal agencies. |
Final verification checklist
- Chrome or the relevant Chromium browser is updated.
- The browser has been relaunched, not merely allowed to download an update.
- The About page shows the expected fixed build or a newer supported build.
- Stable, Extended Stable, Beta, and Dev installations have been checked where applicable.
- VDI, kiosk, remote-desktop, portable, and golden-image deployments have been updated.
- Edge and other Chromium browsers have been checked against their own vendor-specific advisories.
- Security telemetry has been reviewed for devices that remained unpatched during the exploitation period.
Frequently Asked Questions
Is CVE-2024-7971 still a current Chrome vulnerability?
CVE-2024-7971 was a Chrome vulnerability patched in August 2024, and the “sixth zero-day” report is historical. Chrome users should run the current supported browser release rather than treat Chrome 128.0.6613.84 or .85 as a current recommended version.
What Chrome version fixed CVE-2024-7971?
Google reported Chrome 128.0.6613.84 as the fixed Linux build and Chrome 128.0.6613.84 or .85 as the fixed Windows and macOS builds. NVD lists versions before 128.0.6613.84 as affected.
Did updating Chrome also update Microsoft Edge?
No. Chrome and Microsoft Edge share Chromium components but receive separate vendor updates. NVD lists Microsoft Edge versions below 128.0.2739.42 as affected, so Edge administrators needed to verify Edge independently.
Does exploitation of CVE-2024-7971 prove that a device was compromised?
No. Google confirmed exploitation in the wild, but an unpatched installation only establishes potential exposure. Confirmed compromise requires device, browser, proxy, identity, or endpoint evidence, and a complete attack may require additional vulnerabilities or techniques.
The Bottom Line
CVE-2024-7971 was an exploited V8 type-confusion vulnerability fixed by Chrome 128 in August 2024, which is why contemporary reporting called it Google’s sixth exploited Chrome zero-day of 2024. The correct response was to update, relaunch, verify the browser build, audit managed and alternate Chromium installations, and investigate suspicious activity on systems that remained unpatched.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →
