Google Chrome Zero-Day Bug Under Attack, Allows Code Injection

Google patched an actively exploited high-severity zero-day (CVE-2024-0519) in Chrome’s V8 JavaScript engine that allows out-of-bounds memory access and could enable code execution or bypass protections like ASLR. The advisory notes this is the first Chrome zero-day disclosed in 2024, one of multiple V8-related fixes released the same week, and places the vulnerability in the context of an increasing number of browser zero-days that pose broad risk due to Chrome’s large market share.