CVE-2024-0814: Google Chrome XSS Vulnerability

CVE-2024-0814 Overview

CVE-2024-0814 is a security user interface (UI) spoofing vulnerability in the Payments component of Google Chrome versions prior to 121.0.6167.85. A remote attacker can craft a malicious HTML page that manipulates the browser's security indicators, misleading users about the trustworthiness of a payment interaction. The flaw is tracked under CWE-346: Origin Validation Error and was addressed in the Chrome stable channel update released on January 23, 2024. Fedora 38 and Fedora 39 also received corresponding package updates. Chromium classified the underlying severity as Medium.

Critical Impact
Attackers can spoof payment-related security UI, tricking users into trusting fraudulent transaction prompts and disclosing financial data.

Affected Products

Google Chrome versions prior to 121.0.6167.85
Fedora 38 (chromium package)
Fedora 39 (chromium package)

Discovery Timeline

2024-01-23 - Google releases the Chrome stable channel update addressing the issue
2024-01-24 - CVE-2024-0814 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-0814

Vulnerability Analysis

The defect resides in Chrome's Payments component, which renders trust indicators for online payment flows such as the Payment Request API and Payment Handler surfaces. The component fails to correctly present origin or security context information to the user under attacker-controlled conditions. As a result, a remote page can influence what the user perceives as the authoritative payment origin. User interaction is required, since the attacker must convince a victim to visit a malicious page and proceed through a payment prompt. The flaw does not corrupt memory or grant code execution, but it undermines the integrity of the trust decisions users make during payment workflows.

Root Cause

The root cause maps to CWE-346: Origin Validation Error. Chrome's Payments UI does not consistently validate or display the true origin backing a payment surface, allowing a crafted HTML page to render misleading security context. Google and the Chromium project have not publicly released implementation-level details for this issue. Refer to the Chromium bug report #1463935 for restricted technical discussion.

Attack Vector

Exploitation occurs over the network through a crafted web page. The attacker hosts HTML that invokes Chrome payment UI in a way that suppresses or spoofs the security indicator identifying the true merchant or handler origin. A victim who interacts with the fraudulent prompt may authorize a payment, submit card data, or complete a transaction believing it originates from a legitimate site. Public proof-of-concept code is not available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

No verified exploit code is available for this vulnerability. See the Chrome Stable Channel Update for the vendor advisory.

Detection Methods for CVE-2024-0814

Indicators of Compromise

Chrome browser build numbers below 121.0.6167.85 observed in endpoint inventory or user-agent telemetry.
User reports of payment prompts displaying inconsistent, missing, or unexpected merchant origins.
Web traffic to newly registered domains hosting payment forms that mimic known merchants.

Detection Strategies

Query endpoint management data for installed Chrome versions and flag any host running a build older than 121.0.6167.85.
Correlate DNS and proxy logs with threat-intelligence feeds for payment-themed phishing infrastructure targeting employees.
Monitor Fedora 38 and Fedora 39 systems for chromium package versions that predate the referenced Fedora package announcements.

Monitoring Recommendations

Ingest browser version telemetry into a centralized log platform and alert on outdated Chrome installations.
Track user-reported phishing and payment fraud tickets to identify clusters that could indicate spoofed payment UI abuse.
Review egress web proxy logs for interactions with payment endpoints on suspicious or lookalike domains.

How to Mitigate CVE-2024-0814

Immediate Actions Required

Update Google Chrome to version 121.0.6167.85 or later on all managed endpoints.
Apply the Fedora chromium updates referenced in the Fedora package announcement 1 and package announcement 2.
Force a browser relaunch through enterprise policy so pending Chrome updates take effect.
Reinforce user awareness on validating payment origins and inspecting the address bar during checkout.

Patch Information

Google addressed CVE-2024-0814 in the Chrome stable channel release on January 23, 2024, at version 121.0.6167.85. Full release details are documented in the Chrome Stable Channel Update. Fedora shipped corresponding chromium package updates for Fedora 38 and Fedora 39 through the Fedora Project package-announce mailing list.

Workarounds

Restrict use of Chrome for payment activities on unpatched endpoints until the update is deployed.
Prefer merchant-native mobile applications or verified desktop clients for high-value payment workflows during the remediation window.
Enforce enterprise browser policies that block navigation to known phishing and payment-fraud domains through DNS or secure web gateway controls.

bash

# Verify installed Chrome version on Linux endpoints
google-chrome --version

# Update chromium on Fedora 38 / 39
sudo dnf upgrade --refresh chromium

# Confirm the installed chromium version meets or exceeds the fixed build
rpm -q chromium