CVE-2024-5274
Google Chromium V8 Type Confusion Vulnerability
Description
CVE-2024-5274 is a critical type confusion vulnerability in the V8 JavaScript engine of Google Chrome that allows a remote attacker to execute arbitrary code inside the browser sandbox through a crafted HTML page. With a CVSS v3.1 base score of 9.6, this vulnerability affects Chrome versions prior to 125.0.6422.112 and represents one of the most severe V8 engine flaws exploited in 2024. CISA has added CVE-2024-5274 to the Known Exploited Vulnerabilities catalog with a remediation deadline of June 18, 2024, and the ransomware association is currently unknown. Its EPSS score of 3.60% at the 87.5th percentile reflects significant exploitation probability, consistent with targeted zero-day exploitation confirmed by Google's Threat Analysis Group.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| chrome | < 125.0.6422.112 | |
| fedoraproject | fedora | 39; 40 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
References
- https://chromereleases.googleblog.com/2024/05/stable-channel-update-for-desktop_23.html(Release Notes)
- https://issues.chromium.org/issues/341663589(Exploit, Issue Tracking)
- https://lists.fedoraproject.org/archives/list/[email protected]/message/AVC3FNI7HZLVSRIFBVUSBHI233DZYBKP/(Mailing List)
- https://lists.fedoraproject.org/archives/list/[email protected]/message/T6IBUYVPD4MIFQNNYBGAPI5MOECWXXOB/(Mailing List)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-5274(US Government Resource)
Weakness Type
Type Confusion in V8 JavaScript Engine
CVE-2024-5274 is a type confusion vulnerability in Chrome's V8 JavaScript engine. Type confusion occurs when a program allocates or initializes a resource as one type but later accesses it as a different, incompatible type, leading to logical errors and memory corruption. In the V8 engine, type confusion vulnerabilities are particularly dangerous because V8 performs aggressive just-in-time (JIT) compilation optimizations that rely on type assumptions. When these assumptions are violated through a crafted JavaScript payload, the engine may access memory with incorrect type information, enabling an attacker to read or write arbitrary memory within the renderer process. Type confusion in V8 is a recurring attack surface that has been exploited in multiple zero-day campaigns. Learn more about type confusion at CWE-843.
Impact Analysis
The impact of CVE-2024-5274 is critical, with the CVSS vector reflecting near-maximum severity across all dimensions with a changed scope. Confidentiality is fully compromised within the sandbox because the type confusion enables arbitrary memory reads within the Chrome renderer process, potentially exposing page contents, cookies, authentication tokens, and other sensitive data from the browsing session. The changed scope (S:C) indicates that the impact extends beyond the V8 engine to affect the broader renderer process and potentially other security boundaries.
Integrity faces maximum impact as arbitrary code execution within the sandbox allows the attacker to manipulate page content, intercept user input, inject malicious scripts, and potentially forge requests to authenticated web services. When combined with a sandbox escape vulnerability, the impact extends to full system compromise.
Availability is completely at risk since the attacker can crash the renderer process or cause persistent denial of service conditions. The network attack vector (AV:N), low complexity (AC:L), no privileges required (PR:N), and only requiring the user to visit a malicious page (UI:R) make this vulnerability exploitable at scale through drive-by download attacks, malvertising campaigns, or targeted watering hole attacks. The EPSS score at the 87.5th percentile confirms active exploitation, and the Chromium issue tracker entry at issues.chromium.org is tagged as an exploit, confirming real-world weaponization.
Exploit Maturity
CVE-2024-5274 has confirmed active exploitation as a zero-day, with Google acknowledging that an exploit existed in the wild before the patch was released. CISA has included it in the Known Exploited Vulnerabilities catalog with a remediation deadline of June 18, 2024. The EPSS score of 3.60% at the 87.5th percentile reflects significant exploitation probability for a browser vulnerability.
The vulnerability was disclosed in the Chrome stable channel update on May 23, 2024, with Google confirming awareness of an exploit in the wild. The associated Chromium bug tracker entry is tagged as an exploit, confirming weaponized exploitation. CVE-2024-5274 was the fourth zero-day vulnerability patched in Chrome during May 2024, following CVE-2024-4671, CVE-2024-4761, and CVE-2024-4947, indicating an intense period of V8 exploitation activity.
The ransomware association remains unknown, though V8 type confusion vulnerabilities are more commonly associated with targeted espionage operations, surveillance software deployment, and high-value targeted attacks rather than broad ransomware campaigns. The exploitation requires luring a victim to a malicious web page, making it suitable for spear-phishing and watering hole attack scenarios.
Remediation
-
Update Google Chrome to version 125.0.6422.112 or later immediately. Open Chrome, navigate to Settings > About Chrome, and ensure the browser updates to the latest version. Enterprise administrators should push the update through their browser management platform as an emergency deployment.
-
Update all Chromium-based browsers. Microsoft Edge, Brave, Opera, Vivaldi, and other browsers built on the Chromium engine share the V8 JavaScript engine and are also affected. Verify that all Chromium-based browsers across the organization are updated to versions that incorporate the fix.
-
Enable automatic browser updates organization-wide. Configure group policies or device management settings to ensure Chrome and other browsers receive automatic updates without delay. For enterprise environments, set the Chrome update policy to allow updates within 24 hours of release for critical security patches.
-
Implement network-level protections. Deploy web filtering and threat intelligence feeds that block known exploitation infrastructure and malicious domains associated with V8 exploit campaigns. Content Security Policy headers on your own web applications can reduce the risk of injected exploit scripts.
-
Educate users about targeted phishing threats. Since exploitation requires visiting a malicious page, train users to be cautious about clicking unfamiliar links, especially in targeted phishing emails. Implement email security controls that scan and sandbox URLs before users can access them.
Technical Details
CVE-2024-5274 is a type confusion vulnerability in the V8 JavaScript engine with a CVSS v3.1 vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, resulting in a critical base score of 9.6. The network attack vector (AV:N) means exploitation can occur remotely when a user visits a malicious web page. The low attack complexity (AC:L) indicates the exploit works reliably without special conditions, and no authentication is required (PR:N). The only requirement is user interaction (UI:R) in the form of navigating to the attacker-controlled page.
The type confusion vulnerability exists within V8's handling of JavaScript objects during JIT compilation and execution. V8 uses a sophisticated type system to track the types of JavaScript values for optimization purposes. When the engine's type tracking becomes inconsistent — through specific sequences of JavaScript operations that violate V8's internal type assumptions — the engine may access an object through an incompatible type pointer. This allows an attacker to construct a JavaScript payload that causes V8 to misinterpret the memory layout of an object, enabling controlled out-of-bounds reads and writes within the renderer process memory.
The changed scope (S:C) reflects that exploitation transcends the V8 engine's boundaries to compromise the entire renderer process. From this position, the attacker achieves full impact on confidentiality (C:H), integrity (I:H), and availability (A:H) within the sandboxed renderer. While Chrome's multi-process architecture and sandbox provide defense-in-depth, a renderer compromise still exposes all data within the affected browsing context. Chrome versions prior to 125.0.6422.112 are affected, along with Fedora 39 and 40 which distribute Chromium packages.
Frequently Asked Questions
What is CVE-2024-5274?
CVE-2024-5274 is a critical type confusion vulnerability in Chrome's V8 JavaScript engine that allows a remote attacker to execute arbitrary code within the browser sandbox by luring a victim to a crafted web page. It has a CVSS v3.1 score of 9.6 and was exploited as a zero-day in the wild.
How is CVE-2024-5274 exploited?
An attacker creates a malicious web page containing specially crafted JavaScript that triggers the type confusion in V8. When a victim visits the page, the exploit executes arbitrary code within Chrome's renderer process. The attack requires no authentication and no special conditions beyond the victim navigating to the page.
Are other Chromium-based browsers affected?
Yes. All browsers built on the Chromium engine that use the V8 JavaScript engine are potentially affected, including Microsoft Edge, Brave, Opera, and Vivaldi. Users should update all Chromium-based browsers to versions that incorporate the fix for CVE-2024-5274.
Can CVE-2024-5274 lead to full system compromise?
The vulnerability by itself allows code execution within Chrome's sandbox. Full system compromise would require chaining CVE-2024-5274 with a separate sandbox escape vulnerability. However, even within the sandbox, the attacker can access all data in the affected browsing context, including cookies, authentication tokens, and page contents.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.