CVE-2024-0333: Google Chrome Auth Bypass Vulnerability

CVE-2024-0333 Overview

CVE-2024-0333 is an insufficient data validation flaw in the Extensions component of Google Chrome prior to version 120.0.6099.216. An attacker positioned in a privileged network location can exploit the weakness using a crafted HTML page to install a malicious browser extension. Chromium classifies the underlying security severity as High, though the NVD CVSS score is 5.3 due to the high attack complexity and user interaction requirements. The flaw affects Google Chrome desktop builds and downstream Fedora packages on Fedora 38 and Fedora 39.

Critical Impact

Successful exploitation enables silent installation of attacker-controlled Chrome extensions, leading to persistent browser compromise, credential theft, and session hijacking.

Affected Products

• Google Chrome versions prior to 120.0.6099.216
• Fedora 38 (chromium package)
• Fedora 39 (chromium package)

Discovery Timeline

• 2024-01-10 - CVE-2024-0333 published to the National Vulnerability Database
• 2025-06-03 - Last updated in NVD database

Technical Details for CVE-2024-0333

Vulnerability Analysis

The vulnerability resides in Chrome's Extensions subsystem, where data validation routines fail to adequately verify content delivered through a crafted HTML page. An attacker with a privileged network position can manipulate the extension installation flow without triggering Chrome's standard user-consent or origin checks. The result is an Input Validation Error that bypasses safeguards intended to prevent unsolicited extension installs.

Because extensions in Chrome run with broad privileges over web content, page DOM, cookies, and outbound requests, a malicious extension installed through this flaw can read authenticated sessions, modify pages, exfiltrate browser data, and persist across browser restarts. The integrity impact is rated High while confidentiality and availability impacts are not directly affected at the browser process level.

Root Cause

The root cause is insufficient validation of data processed by the Extensions component when handling specially crafted HTML content. The NVD assigns [CWE-NVD-CWE-noinfo] because Google has not publicly disclosed the precise weakness class, consistent with Chromium's standard vulnerability disclosure practice. Public detail is limited to the Chromium bug tracker entry crbug.com/1513379, which remains restricted.

Attack Vector

Exploitation requires an attacker to occupy a privileged network position, such as a compromised upstream router, a hostile Wi-Fi access point, or an on-path adversary capable of intercepting and modifying HTTP traffic. The attacker serves a crafted HTML page to a targeted Chrome user. User interaction is required, raising attack complexity, and no authentication is needed against the victim.

The vulnerability mechanism is not accompanied by public proof-of-concept code. The Chromium bug report #1513379 remains access-restricted, and no exploit has been published on Exploit-DB or referenced by CISA KEV. For technical specifics, refer to the Google Chrome Release Update.

Detection Methods for CVE-2024-0333

Indicators of Compromise

• Unexpected entries under the Chrome Extensions directory or unfamiliar IDs in chrome://extensions
• Modifications to the Preferences and Secure Preferences files in the Chrome user data directory referencing unknown extension IDs
• Outbound connections from the Chrome process to unfamiliar domains shortly after a user visits a site over an untrusted network
• Browser policy or sync state changes that the user did not initiate

Detection Strategies

• Inventory installed Chrome extensions across the fleet and compare against an approved allowlist
• Monitor Chrome update telemetry to identify endpoints running versions older than 120.0.6099.216
• Inspect HTTP/HTTPS traffic on managed networks for crafted responses targeting extension installation endpoints under chrome.google.com and clients2.google.com
• Alert on Chrome child processes spawning unexpected helper executables associated with newly installed extensions

Monitoring Recommendations

• Forward Chrome extension install/uninstall events from chrome://extensions-internals logs or enterprise reporting into centralized log analytics
• Track DNS and proxy logs for connections to known malicious extension command-and-control infrastructure
• Enable enterprise Chrome reporting via the Chrome Enterprise connectors to surface extension installs in SIEM platforms

How to Mitigate CVE-2024-0333

Immediate Actions Required

• Update Google Chrome to version 120.0.6099.216 or later on all managed endpoints
• Apply the Fedora chromium package updates referenced in the Fedora 38 announcement and Fedora 39 announcement
• Audit installed extensions on enterprise endpoints and remove anything not on the corporate allowlist
• Restart Chrome after patching so the updated binary loads on every managed device

Patch Information

Google addressed CVE-2024-0333 in the Chrome Stable channel release 120.0.6099.216 for Windows, macOS, and Linux, announced on January 9, 2024. Fedora published rebuilt chromium packages for Fedora 38 and Fedora 39 through the standard package-announce channels. Administrators should validate the running version via chrome://settings/help or the Chrome Browser Cloud Management console after deployment.

Workarounds

• Restrict permitted extensions using the ExtensionInstallAllowlist and ExtensionInstallBlocklist enterprise policies until patches are deployed
• Disable extension installation entirely with ExtensionInstallBlocklist set to * on high-risk endpoints
• Require users on untrusted networks to route browser traffic through a trusted VPN to reduce exposure to on-path attackers
• Enforce HTTPS-only mode in Chrome to limit opportunities for HTML injection by network adversaries

# Configuration example: Chrome enterprise policy on Linux
# /etc/opt/chrome/policies/managed/extensions.json
{
  "ExtensionInstallBlocklist": ["*"],
  "ExtensionInstallAllowlist": [
    "approved_extension_id_1",
    "approved_extension_id_2"
  ],
  "HttpsOnlyMode": "force_enabled"
}