CVE-2024-4059 – This vulnerability is an out-of-bounds read in ... (How to Fix)

Q: What is the severity of CVE-2024-4059?

CVE-2024-4059 has a CVSS score of 6.5 (MEDIUM). This vulnerability is an out-of-bounds read in Chrome's V8 JavaScript engine that allows a remote attacker to leak cross-site data via a crafted HTML page. It affects Google Chrome users running versions prior to 124.0.6367.78. Attackers can exploit this to bypass same-origin policy protections and access sensitive information from other websites.

📋 TL;DR

This vulnerability is an out-of-bounds read in Chrome's V8 JavaScript engine that allows a remote attacker to leak cross-site data via a crafted HTML page. It affects Google Chrome users running versions prior to 124.0.6367.78. Attackers can exploit this to bypass same-origin policy protections and access sensitive information from other websites.

💻 Affected Systems

Products:

Google Chrome
Chromium-based browsers

Versions: All versions prior to 124.0.6367.78

Operating Systems: Windows, macOS, Linux, Android, iOS

Default Config Vulnerable: ⚠️ Yes

Notes: All standard Chrome installations are vulnerable. Chromium-based browsers may also be affected depending on their V8 version.

📦 What is this software?

Chrome by Google

Google Chrome is the world's most popular web browser, used by over 3 billion users globally across Windows, macOS, Linux, Android, and iOS platforms. As a Chromium-based browser developed by Google, Chrome dominates the browser market with approximately 65% market share, making it a critical compon...

Learn more about Chrome →

Fedora by Fedoraproject

View all CVEs affecting Fedora →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete compromise of user session data across multiple websites, including authentication tokens, personal information, and financial data, potentially leading to account takeover and identity theft.

🟠

Likely Case

Targeted data exfiltration from specific websites visited by the user, such as stealing login credentials, session cookies, or sensitive form data from banking or email sites.

🟢

If Mitigated

No data leakage if Chrome is fully patched or if vulnerable versions are isolated from untrusted web content.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ⚠️ Yes

Complexity: MEDIUM

Exploitation requires user interaction (visiting a malicious webpage) but no authentication. The vulnerability is in the V8 engine which is complex to exploit reliably.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 124.0.6367.78

Vendor Advisory: https://chromereleases.googleblog.com/2024/04/stable-channel-update-for-desktop_24.html

Restart Required: Yes

Instructions:

1. Open Chrome. 2. Click the three-dot menu → Help → About Google Chrome. 3. Chrome will automatically check for and install updates. 4. Click 'Relaunch' to restart Chrome with the patched version.

🔧 Temporary Workarounds

Disable JavaScript

all

Prevents exploitation by disabling JavaScript execution, but breaks most website functionality.

Use Site Isolation

all

Enhances Chrome's site isolation feature to limit cross-site data leakage.

Navigate to chrome://flags/#site-isolation-trial-opt-out and set to 'Disabled'

🧯 If You Can't Patch

Deploy network filtering to block known malicious domains hosting exploit code.
Implement application allowlisting to restrict browser usage to trusted applications only.

🔍 How to Verify

Check if Vulnerable:

Check Chrome version: Open Chrome → Click three-dot menu → Help → About Google Chrome. If version is below 124.0.6367.78, you are vulnerable.

Check Version:

On Windows: "C:\Program Files\Google\Chrome\Application\chrome.exe" --version
On macOS: /Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version
On Linux: google-chrome --version

Verify Fix Applied:

Confirm Chrome version is 124.0.6367.78 or higher using the same About page.

📡 Detection & Monitoring

Log Indicators:

Unusual Chrome crash reports with V8-related errors
Multiple out-of-bounds memory access warnings in system logs

Network Indicators:

HTTP requests to suspicious domains immediately followed by data exfiltration patterns
Unusual cross-origin resource sharing (CORS) patterns

SIEM Query:

source="chrome_logs" AND (error="V8" OR error="out of bounds") OR process="chrome" AND event="crash"

📊 Metadata

CVE ID: CVE-2024-4059

CVSS v3 Score: 6.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

CWE: CWE-125

Published: May 1, 2024

Last Updated: November 4, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-4059, you might also want to check these: