CVE-2024-0811: Google Chrome Information Disclosure Flaw

CVE-2024-0811 Overview

CVE-2024-0811 is an inappropriate implementation vulnerability in the Extensions API of Google Chrome prior to version 121.0.6167.85. This security flaw allows an attacker who convinces a user to install a malicious browser extension to leak cross-origin data through a crafted Chrome Extension. The vulnerability specifically involves the chrome.pageCapture.saveAsMHTML extension API, which can be exploited to bypass blocked origin restrictions.

Critical Impact

Malicious Chrome extensions can exploit this vulnerability to access and exfiltrate sensitive cross-origin data, potentially compromising user privacy and exposing confidential information from other websites the user visits.

Affected Products

• Google Chrome versions prior to 121.0.6167.85
• Fedora 38 (with bundled Chromium packages)
• Fedora 39 (with bundled Chromium packages)

Discovery Timeline

• 2024-01-24 - CVE-2024-0811 published to NVD
• 2025-06-16 - Last updated in NVD database

Technical Details for CVE-2024-0811

Vulnerability Analysis

This vulnerability stems from an inappropriate implementation in Google Chrome's Extensions API, specifically affecting how the browser handles cross-origin data access requests from extensions. The flaw resides in the chrome.pageCapture.saveAsMHTML API functionality, which is designed to allow extensions to capture web page content as MHTML archives.

Under normal circumstances, Chrome enforces strict origin isolation policies to prevent extensions from accessing data from origins they are not permitted to interact with. However, due to this implementation flaw, a maliciously crafted extension can circumvent these protections and extract data from blocked origins.

The attack requires user interaction, as the victim must be convinced to install the malicious extension. Once installed, the extension can silently harvest cross-origin data without additional user consent or visible indicators.

Root Cause

The root cause lies in insufficient validation within the Extensions API's origin-checking mechanism. The chrome.pageCapture.saveAsMHTML API failed to properly enforce origin restrictions when capturing page content, allowing extensions to access MHTML representations of pages from origins that should have been blocked. This represents a failure in the security boundary between extension capabilities and cross-origin resource protection.

Attack Vector

The attack leverages network-based delivery combined with social engineering. An attacker must first create a malicious Chrome extension that exploits the chrome.pageCapture.saveAsMHTML API vulnerability. The attack proceeds as follows:

1. The attacker develops a Chrome extension that appears benign but contains code to exploit the API flaw
2. The victim is tricked into installing the extension through social engineering, phishing, or distribution through unofficial channels
3. Once installed, the extension uses the vulnerable API to capture MHTML content from cross-origin pages
4. Sensitive data from other websites the user visits is extracted and exfiltrated to attacker-controlled infrastructure

The vulnerability requires user interaction for the initial extension installation, but subsequent data exfiltration occurs without additional user consent. Technical details are available in the Packet Storm Exploit Report and the Chromium Issue Tracker Entry.

Detection Methods for CVE-2024-0811

Indicators of Compromise

• Presence of unfamiliar or recently installed Chrome extensions with pageCapture API permissions
• Unusual network traffic from browser processes to unknown external domains
• Extensions requesting broader permissions than their stated functionality requires
• Browser extension audit logs showing saveAsMHTML API calls targeting unexpected origins

Detection Strategies

• Monitor Chrome extension installations across enterprise environments using group policy or endpoint management tools
• Implement browser extension allowlisting to prevent installation of unapproved extensions
• Review installed extensions for those requesting pageCapture permissions
• Deploy network monitoring to detect anomalous data exfiltration patterns from browser processes

Monitoring Recommendations

• Enable Chrome enterprise logging to track extension API usage and installation events
• Configure SIEM rules to alert on new extension installations, particularly those with sensitive permissions
• Implement regular audits of installed browser extensions across the organization
• Monitor for connections to newly registered domains from Chrome processes

How to Mitigate CVE-2024-0811

Immediate Actions Required

• Update Google Chrome to version 121.0.6167.85 or later immediately
• Audit all installed Chrome extensions and remove any unauthorized or suspicious extensions
• Enforce Chrome browser policies to restrict extension installation sources
• Educate users about the risks of installing browser extensions from untrusted sources

Patch Information

Google has addressed this vulnerability in Chrome version 121.0.6167.85, released on January 23, 2024. The fix properly enforces origin restrictions in the Extensions API to prevent cross-origin data leakage. Users and administrators should update to this version or later through Chrome's automatic update mechanism or by downloading directly from Google. For detailed information, see the Google Chrome Update Announcement.

Fedora users should apply the latest Chromium package updates as announced in the Fedora Package Announcements.

Workarounds

• Implement Chrome extension allowlisting via enterprise policies to prevent installation of unauthorized extensions
• Disable the chrome.pageCapture API through Chrome policy if not required for business operations
• Deploy endpoint protection solutions that can monitor and block malicious extension behavior
• Use Chrome's Safe Browsing enhanced protection mode for additional defense against malicious extensions

# Chrome Enterprise Policy Configuration (Linux/macOS)
# Block all extensions except those explicitly allowed
# Add to /etc/opt/chrome/policies/managed/extension_policy.json
{
  "ExtensionInstallBlocklist": ["*"],
  "ExtensionInstallAllowlist": ["<approved_extension_id_1>", "<approved_extension_id_2>"]
}