CVE-2024-0519
Google Chromium V8 Out-of-Bounds Memory Access Vulnerability
Description
CVE-2024-0519 is a high-severity out-of-bounds memory access vulnerability in the V8 JavaScript engine used by Google Chrome prior to version 120.0.6099.224. A remote attacker can exploit this flaw by luring a victim to visit a crafted HTML page, potentially triggering heap corruption that could lead to code execution or sensitive memory disclosure. The vulnerability carries a CVSS v3.1 score of 8.8 and is listed in CISA's Known Exploited Vulnerabilities catalog with a remediation deadline of February 7, 2024. Organizations and end users running unpatched versions of Chrome (or Chromium-based browsers) are at risk, and the fix is available through a stable channel update released on January 16, 2024.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| chrome | < 120.0.6099.224 | |
| fedoraproject | fedora | 38; 39 |
| couchbase | couchbase server | < 7.2.5 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://chromereleases.googleblog.com/2024/01/stable-channel-update-for-desktop_16.html(Release Notes)
- https://crbug.com/1517354(Permissions Required)
- https://lists.fedoraproject.org/archives/list/[email protected]/message/IIUBRVICICWREJQUVT67RS7E4PVZQ5RS/(Broken Link, Mailing List)
- https://lists.fedoraproject.org/archives/list/[email protected]/message/TNN4SO5UI3U3Q6ASTVT6WMZ4723FYDLH/(Broken Link, Mailing List)
- https://www.couchbase.com/alerts/(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-0519(US Government Resource)
Weakness Type
CWE-787: Out-of-Bounds Write
The primary weakness is classified under CWE-787: Out-of-Bounds Write. This occurs when software writes data past the end or before the beginning of an intended buffer, which can corrupt adjacent memory regions and lead to unpredictable behavior including arbitrary code execution.
CWE-125: Out-of-Bounds Read
An additional weakness is CWE-125: Out-of-Bounds Read. This weakness occurs when software reads data from a memory location outside the bounds of an allocated buffer, potentially allowing attackers to read sensitive data from adjacent memory areas.
Both weaknesses arise from memory safety issues in the V8 engine's handling of JavaScript operations. The interaction between out-of-bounds reads and writes can lead to heap corruption scenarios that attackers may leverage to achieve controlled memory manipulation.
Impact Analysis
Confidentiality Impact (HIGH): Out-of-bounds memory reads in V8 can expose sensitive data from adjacent heap regions, potentially including pointers, cryptographic material, or data from other browser processes or tabs.
Integrity Impact (HIGH): Out-of-bounds writes allow an attacker to corrupt heap memory, which can be used to overwrite function pointers or other control data structures, enabling arbitrary code execution within the renderer process.
Availability Impact (HIGH): Heap corruption caused by this vulnerability can crash the browser process (renderer or even browser process depending on exploitation), causing denial of service.
Scope: User interaction is required (visiting a malicious page), which limits automated exploitation but does not significantly reduce real-world risk given the ubiquity of browsers in daily workflows. The attack complexity is rated LOW once a user visits a crafted page, making exploitation accessible to a broad range of threat actors. Fedora Linux and Couchbase Server are also listed as affected products, as they ship or depend on Chromium/V8.
Exploit Maturity
Exploitation Status: CVE-2024-0519 is confirmed as actively exploited in the wild. CISA added this CVE to the Known Exploited Vulnerabilities catalog, establishing a mandatory remediation deadline of February 7, 2024 for federal agencies.
EPSS Score: The EPSS score of 0.00448 (63rd percentile) indicates a moderate statistical prediction of exploitation relative to all CVEs; however, the confirmed active exploitation in KEV overrides this statistical estimate and should be the primary driver of urgency.
Ransomware Association: The KEV entry records ransomware association as Unknown, meaning no direct link to ransomware campaigns has been confirmed at the time of cataloging, though other threat actors actively exploited this vulnerability.
Attack Conditions: Exploitation requires that the victim visit a maliciously crafted HTML page. Browser-based exploits of this type are frequently delivered through phishing campaigns, malicious advertisements (malvertising), or compromised websites, lowering the bar for wide-scale exploitation.
Remediation
- Update Google Chrome immediately: Install Chrome version 120.0.6099.224 or later via the browser's built-in update mechanism (Help > About Google Chrome) or through your organization's software deployment pipeline.
- Update other Chromium-based browsers: Browsers based on Chromium (Microsoft Edge, Brave, Opera, etc.) may share the same V8 engine. Check and apply updates to all Chromium-derived browsers in use.
- Update Fedora packages: If running Fedora Linux, apply the updated Chromium package from the Fedora package repositories as referenced in the mailing list advisory.
- Update Couchbase Server: Consult the Couchbase security alerts page and apply any patches that address the embedded Chromium/V8 component.
- Enforce browser update policies: Use enterprise management tools (e.g., Google Admin, Intune) to enforce minimum browser version requirements and verify patch compliance across managed endpoints.
- Consider browser isolation: For high-risk environments, deploy browser isolation or sandboxing technologies to limit the impact of browser-based exploits.
- Educate users: Remind users to avoid clicking on unsolicited links from unknown sources, as exploitation requires visiting a crafted page.
Technical Details
Vulnerability Class: Out-of-bounds memory access (read and write) in the V8 JavaScript engine embedded in Google Chrome and other Chromium-based products.
Affected Component: V8 JavaScript engine in Google Chrome versions prior to 120.0.6099.224. Additional affected products include Fedora (Chromium packages) and Couchbase Server (which embeds V8/Chromium).
Attack Vector: Network (AV:N) — exploitable by a remote attacker when a user visits a crafted HTML page.
User Interaction Required: Yes (UI:R) — the victim must navigate to the attacker-controlled or compromised web page.
Mechanism: The V8 engine's handling of specific JavaScript constructs contains memory safety errors that allow reads and writes outside the boundaries of allocated heap buffers. Exploiting heap corruption typically involves manipulating the heap layout to place attacker-controlled data at predictable offsets, then corrupting adjacent objects to achieve controlled program behavior.
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE Classification: CWE-787 (Out-of-Bounds Write), CWE-125 (Out-of-Bounds Read)
Fixed Version: Chrome 120.0.6099.224 (stable channel update, January 16, 2024).
Frequently Asked Questions
Which browsers are affected by CVE-2024-0519?
Google Chrome prior to version 120.0.6099.224 is the primary affected browser. Because many browsers share the Chromium codebase and V8 engine — including Microsoft Edge, Brave, and Opera — those products may also be vulnerable if they had not incorporated the fix at the time of disclosure. Fedora Linux ships Chromium packages that were also affected. Users of all Chromium-based browsers should verify that they are running updated versions.
Does exploitation require any action from the victim?
Yes. The attack requires that the victim visit a specially crafted HTML page. This user interaction is rated as REQUIRED in the CVSS vector. However, browser-based exploits are commonly delivered through phishing emails, malicious ads, or compromised legitimate websites, making the bar for delivery relatively low in practice.
Is CVE-2024-0519 linked to ransomware?
The KEV catalog entry for CVE-2024-0519 records the ransomware association as Unknown — no confirmed direct link to ransomware campaigns has been documented. However, the vulnerability is confirmed as actively exploited by threat actors, making prompt patching essential regardless of ransomware association.
How do I check if Chrome is patched?
Open Chrome and navigate to the menu (three dots) > Help > About Google Chrome. The browser will display the current version and automatically check for updates. You should be running version 120.0.6099.224 or later. If an update is available, apply it immediately and restart the browser to complete the update.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.