CVE-2024-10229: Google Chrome Auth Bypass Vulnerability

CVE-2024-10229 Overview

CVE-2024-10229 is a high-severity vulnerability in Google Chrome caused by an inappropriate implementation in the Extensions component. The flaw affects Chrome versions prior to 130.0.6723.69 and allows a remote attacker to bypass site isolation through a crafted Chrome extension. Site isolation is a core browser security boundary that separates web content from different origins into distinct processes. A successful bypass undermines the integrity and confidentiality protections that Chrome enforces between sites. Google classifies the Chromium security severity as High, and the CVSS 3.1 base score is 8.1.

Critical Impact
A remote attacker who convinces a user to install a crafted Chrome extension can bypass site isolation, compromising the confidentiality and integrity of data across origins.

Affected Products

Google Chrome (Desktop) versions prior to 130.0.6723.69
Chromium-based builds using the same Extensions implementation prior to the 130 release
Any Chrome installation that has not received the October 22, 2024 Stable Channel update

Discovery Timeline

2024-10-22 - Google releases the Stable Channel update for desktop addressing the issue
2024-10-22 - CVE-2024-10229 published to NVD
2024-10-25 - Last updated in NVD database

Technical Details for CVE-2024-10229

Vulnerability Analysis

The vulnerability resides in Chrome's Extensions subsystem. Site isolation is the architectural control that places each site in its own renderer process, preventing one origin from reading or tampering with another. The inappropriate implementation in Extensions allows a crafted extension to break that boundary. The CWE is classified as NVD-CWE-noinfo because Google has not published full technical details, consistent with its disclosure practice of limiting information until users have updated. Public exploit code is not available, and the EPSS probability is low. The attack vector is network-based but requires user interaction, specifically installation of the malicious extension.

Root Cause

The root cause is an inappropriate implementation within the Extensions component of Chrome prior to 130.0.6723.69. The defect permits extension-supplied logic to operate outside the constraints that site isolation is intended to enforce. Details beyond this categorization are restricted in the public Chromium issue tracker entry #371011220.

Attack Vector

Exploitation requires a user to install a crafted Chrome extension. Once installed, the extension leverages the implementation flaw to cross site isolation boundaries and access content or state from origins it should not reach. The vector aligns with supply chain abuse of the Chrome Web Store, sideloaded extensions via enterprise policy, or social engineering campaigns that push attacker-controlled extensions.

No verified proof-of-concept code is publicly available. Technical specifics are tracked in the Chromium Issue Tracker #371011220 and the Google Chrome Stable Update advisory.

Detection Methods for CVE-2024-10229

Indicators of Compromise

Chrome browser processes reporting version strings below 130.0.6723.69 in endpoint inventory data
Newly installed or sideloaded Chrome extensions with broad host permissions such as <all_urls> or *://*/*
Extensions loaded from developer mode or unpacked sources outside of the Chrome Web Store on managed endpoints
Unexpected cross-origin network requests originating from extension service workers or background pages

Detection Strategies

Inventory installed Chrome extensions across the fleet and correlate their IDs against an approved allowlist.
Monitor for Chrome version drift using endpoint telemetry, flagging hosts that remain below 130.0.6723.69.
Hunt for extensions that request webRequest, tabs, cookies, or wide host permissions and were installed after the disclosure date.
Review enterprise policy changes that alter ExtensionInstallForcelist or ExtensionInstallAllowlist settings.

Monitoring Recommendations

Forward Chrome management telemetry and extension install events into the SIEM for longitudinal analysis.
Alert on installation of extensions from outside the Chrome Web Store or from unknown publishers.
Track outbound DNS and HTTPS traffic from browser processes to identify anomalous cross-site data flows.
Schedule recurring scans that compare deployed Chrome builds against the fixed version 130.0.6723.69 or later.

How to Mitigate CVE-2024-10229

Immediate Actions Required

Update Google Chrome to version 130.0.6723.69 or later on all managed endpoints.
Restart Chrome after the update so the patched binaries are loaded.
Audit currently installed extensions and remove any that are unapproved, unsigned, or unnecessary.
Enforce an extension allowlist through enterprise policy to block installation of untrusted extensions.

Patch Information

Google released the fix in the Chrome Stable Channel update on October 22, 2024, shipping version 130.0.6723.69/.70 for Windows and Mac and 130.0.6723.69 for Linux. See the Google Chrome Stable Channel Update for Desktop for distribution details. The corresponding Chromium tracking entry is Issue #371011220.

Workarounds

Use the ExtensionInstallBlocklist policy set to * and an explicit ExtensionInstallAllowlist to restrict permitted extensions until patching is complete.
Disable developer mode and block sideloaded extensions on managed devices.
Educate users to install extensions only from the Chrome Web Store and only from verified publishers.
Where feasible, isolate browsing of sensitive applications to a fully patched Chrome profile with no extensions installed.

bash

# Configuration example: enforce extension controls via Chrome enterprise policy (Linux JSON)
# Path: /etc/opt/chrome/policies/managed/extension_controls.json
{
  "ExtensionInstallBlocklist": ["*"],
  "ExtensionInstallAllowlist": [
    "<approved-extension-id-1>",
    "<approved-extension-id-2>"
  ],
  "DeveloperToolsAvailability": 2,
  "BlockExternalExtensions": true
}