CVE-2024-0804: Google Chrome Information Disclosure Flaw

CVE-2024-0804 Overview

CVE-2024-0804 is an insufficient policy enforcement vulnerability in the iOS Security UI component of Google Chrome prior to version 121.0.6167.85. A remote attacker can leak cross-origin data by serving a crafted HTML page to a target user. The flaw maps to [CWE-693: Protection Mechanism Failure] and affects Google Chrome and Fedora 38 and 39 distributions that ship the Chromium-based browser. Google rated the underlying Chromium issue as Medium severity, while NVD assigned a higher CVSS score reflecting the confidentiality impact on the network attack surface.

Critical Impact
Remote attackers can bypass Chrome's iOS Security UI policy enforcement to exfiltrate cross-origin data from authenticated user sessions without requiring user interaction or privileges.

Affected Products

Google Chrome versions prior to 121.0.6167.85
Fedora 38 (Chromium package)
Fedora 39 (Chromium package)

Discovery Timeline

2024-01-24 - CVE CVE-2024-0804 published to NVD
2025-05-22 - Last updated in NVD database

Technical Details for CVE-2024-0804

Vulnerability Analysis

The vulnerability resides in Chrome's iOS Security UI, which is responsible for surfacing trust signals and enforcing origin-based protections in the browser. Insufficient policy enforcement in this component allows a malicious site to violate the same-origin policy assumptions that Chrome normally guarantees. An attacker hosting a crafted HTML page can trigger conditions where cross-origin data becomes readable or observable to the attacker-controlled origin.

The issue is classified under [CWE-693: Protection Mechanism Failure], indicating that an intended security control exists but does not operate as expected. Exploitation requires no authentication and no user interaction beyond visiting the attacker's page. While the integrity and availability of the browser are not affected, the confidentiality impact is high because the leaked data may include session-bound information from other origins.

Root Cause

The root cause is incomplete enforcement of cross-origin policy boundaries within Chrome's iOS Security UI layer. The component fails to consistently apply origin checks when handling specific UI-driven security state transitions, leaving a gap that a crafted page can exercise to observe data belonging to a different origin.

Attack Vector

The attack is delivered over the network through a malicious or compromised website. A victim using a vulnerable Chrome build navigates to the page, which contains HTML designed to exercise the policy-enforcement gap. The page then reads or infers cross-origin content that the same-origin policy would normally block. No privileges, credentials, or user interaction on dialogs are required, which makes the flaw suitable for opportunistic drive-by attacks and watering-hole scenarios. Public proof-of-concept code is not available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Further technical details are tracked in the Chrome Bug Report #1515137.

Detection Methods for CVE-2024-0804

Indicators of Compromise

Chrome browser builds reporting a version string lower than 121.0.6167.85 in chrome://version or in HTTP User-Agent headers observed by web proxies.
Outbound connections from end-user hosts to unfamiliar domains immediately followed by anomalous cross-origin requests to authenticated SaaS endpoints.
Browser telemetry showing unexpected navigation to attacker-controlled HTML pages preceding sensitive session activity.

Detection Strategies

Inventory installed Chrome and Chromium packages across managed endpoints and flag any instance below 121.0.6167.85, including Fedora 38 and 39 hosts.
Monitor web proxy and DNS logs for newly registered or low-reputation domains delivering HTML payloads to corporate users.
Correlate browser version data with identity provider logs to identify potentially exposed sessions originating from vulnerable builds.

Monitoring Recommendations

Enable centralized browser update reporting through Chrome Browser Cloud Management or equivalent MDM tooling.
Alert on Fedora hosts that have not received the corresponding Chromium package update referenced in the Fedora Package Announcement.
Track cross-origin request anomalies in CASB or SASE telemetry that correlate with users running outdated Chrome versions.

How to Mitigate CVE-2024-0804

Immediate Actions Required

Update Google Chrome to version 121.0.6167.85 or later on all desktop and iOS deployments.
Apply the Chromium package updates from Fedora for Fedora 38 and Fedora 39 systems.
Audit endpoint browser inventories and force-restart Chrome processes so that pending updates are applied.

Patch Information

Google released the fix in the stable channel update documented in the Google Chrome Security Update. Fedora published corresponding Chromium package updates referenced in the Fedora Package Announcement. Administrators should validate that the deployed Chrome version is at or above 121.0.6167.85.

Workarounds

Enforce automatic Chrome updates through enterprise policy so that endpoints receive the fix without user action.
Restrict access to untrusted external sites through web filtering until all endpoints are confirmed patched.
Where patching is delayed, instruct users on managed iOS devices to use an alternate browser for sensitive workflows.

bash

# Verify Chrome version on Linux endpoints
google-chrome --version

# Update Chromium on Fedora 38/39
sudo dnf upgrade --refresh chromium