Google Patches Eighth Chrome Zero-Day of 2024, Fixes XML Use-After-Free Flaw

Key points

• Google issued a Chrome patch on Nov. 6 for a high-severity XML component flaw.
• The vulnerability is a use-after-free bug that was exploited in real attacks before the fix.
• An anonymous researcher reported the issue; the attackers remain unidentified.
• It is the eighth Chrome zero-day addressed in 2024.

Google pushed out a Chrome update on November 6 that addresses a high-severity memory-safety defect in the browser's XML handling code. The flaw is a use-after-free condition, meaning memory can be reused after being freed, potentially allowing an attacker to corrupt data or execute code. Google says the bug was already being used in attacks before the fix became available, making it a zero-day.

The report came from a person who chose to remain unnamed. Google did not identify the attackers or describe the scale of exploitation. The patch is available for Chrome users, and IT teams should verify the version and deploy it promptly across managed devices.

This is the eighth Chrome zero-day patched in 2024, underscoring how frequently browser flaws are being weaponized. K-12 environments rely heavily on Chrome for Google Workspace and web-based learning tools, so unpatched browsers represent a significant risk to staff and students.

What to watch: confirm update rollout, monitor for unusual browser behavior, review extension policies, and prepare for possible follow-up details from Google or security researchers. Since no CVE identifier was listed in the available information, tracking may depend on vendor advisories and release notes.

What to do now

1. Immediately verify Chrome version and force update to the latest release across all managed endpoints.
2. Use Google Admin Console or your MDM to push the update and confirm compliance within 24 hours.
3. Prioritize devices used by staff and students for Google Workspace and web-based learning tools.
4. Review browser extension allowlists and disable unapproved extensions that could expand the attack surface.
5. Monitor endpoint and network logs for suspicious Chrome crashes or unexpected child processes.
6. Communicate to staff and students to restart browsers and avoid postponing updates.
7. Track Google Chrome release notes and advisories for follow-up technical details.

Original source

SecurityWeek