Loading story…
Google released a security update for CVE-2024-4671, a high-severity use-after-free vulnerability in Chrome’s Visuals component, and confirmed that an exploit exists in the wild. The flaw could allow remote code execution. An anonymous researcher reported it on May 7, 2024, and Google announced the fix on May 9; the desktop update contained one security fix.
The patched Stable releases are 124.0.6367.201/.202 for Windows and macOS and 124.0.6367.201 for Linux. Extended Stable was updated to 124.0.6367.201 for Windows and macOS, with rollout scheduled over the following days and weeks. Organizations should verify that managed browsers have received the fix or a newer release and prioritize unpatched endpoints because exploitation has been observed.
See which actors are running it and whether you're in range.
2 events from the most recent confirmed update back to the earliest known activity.
An anonymous researcher reported CVE-2024-4671 to Google on May 7, 2024. The high-severity use-after-free vulnerability affects Chrome's Visuals component.
Google released a security update for CVE-2024-4671 and stated that an exploit exists in the wild. Fixed versions are 124.0.6367.201/.202 for Stable on Windows and Mac, 124.0.6367.201 for Stable on Linux, and 124.0.6367.201 for Extended Stable on Windows and Mac.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google released a Chrome Stable channel update to fix **CVE-2026-2441**, a high-severity use-after-free vulnerability in the browser's CSS component that the company said is being exploited in the wild. The flaw, reported by researcher **Shaheen Fazim**, affects Chrome on Windows and macOS before `145.0.7632.75/76` and Chrome on Linux before `144.0.7559.75`, and Google said technical details would remain restricted until more users had updated. According to CSIRT.SK, the bug carries a **CVSS 3.1 score of 8.8** and can let a remote attacker execute arbitrary code within Chrome's sandbox by luring a victim to a specially crafted HTML page. Google credited its internal security tooling, including sanitizers and fuzzing systems, in the broader effort to identify browser flaws, while defenders were urged to update affected systems immediately to the patched versions or later.
Jul 24, 2026
Google released an out-of-band *Chrome Stable* update to fix **CVE-2026-2441**, a high-severity, actively exploited zero-day caused by a **use-after-free in Chrome’s CSS processing**. The flaw allows a remote attacker to trigger **arbitrary code execution within Chrome’s sandbox** via a crafted HTML page, making drive-by exploitation feasible if a user visits a malicious or compromised site. The issue is scored **CVSS 8.8** and has been characterized as **extremely high risk** due to confirmed in-the-wild exploitation. The patched versions include **Chrome 145.0.7632.75** (and `.76` per platform guidance) for Windows and macOS, and **144.0.7559.75** for Linux; organizations should prioritize rapid browser updates across managed endpoints. Public reporting credits **Shaheen Fazim** with discovering and reporting the vulnerability (reported Feb 11, 2026), while Google has not disclosed exploit details, threat actor attribution, or targeting information beyond confirming that an exploit exists in the wild.
Jun 29, 2026
Google released Chrome desktop updates to fix multiple security vulnerabilities, including **actively exploited zero-days** affecting versions older than `125.0.6422.60/.61` on Windows and macOS and older than `125.0.6422.60` on Linux. The most serious issue, `CVE-2024-4947`, is a high-severity **type confusion** flaw in the V8 JavaScript engine that can lead to out-of-bounds memory access and potentially remote code execution; Google said an exploit for the bug exists in the wild. The updates also addressed other flaws, including `CVE-2024-4761`, an out-of-bounds write in V8 and WebAssembly, `CVE-2024-4671`, a use-after-free issue in Visuals, `CVE-2024-4948`, a use-after-free in Dawn, `CVE-2024-4949`, a use-after-free in V8, and `CVE-2024-4950`, an implementation issue in Downloads. Google and national CSIRT reporting warned that successful exploitation could enable code execution, crashes, or exposure of sensitive data, and urged users to update Chrome immediately while some technical details remain temporarily restricted until broad patch adoption.
Aug 15, 2026