CVE-2024-11395: Google Chrome V8 RCE Vulnerability

CVE-2024-11395 Overview

CVE-2024-11395 is a type confusion vulnerability in the V8 JavaScript engine used by Google Chrome versions prior to 131.0.6778.85. A remote attacker can exploit this flaw by serving a crafted HTML page that triggers heap corruption inside V8. Successful exploitation can lead to arbitrary code execution within the renderer process. Google classifies the Chromium security severity as High, and the issue affects Chrome builds on Windows, macOS, and Linux. The weakness is tracked under CWE-843 (Access of Resource Using Incompatible Type).

Critical Impact
A remote attacker can achieve heap corruption and potential arbitrary code execution in the Chrome renderer when a victim loads a malicious HTML page.

Affected Products

Google Chrome prior to 131.0.6778.85 on Microsoft Windows
Google Chrome prior to 131.0.6778.85 on Apple macOS
Google Chrome prior to 131.0.6778.85 on Linux

Discovery Timeline

2024-11-19 - CVE-2024-11395 published to NVD
2024-11-19 - Google releases Chrome 131.0.6778.85 stable channel update addressing the issue
2025-07-29 - Last updated in NVD database

Technical Details for CVE-2024-11395

Vulnerability Analysis

The vulnerability is a type confusion bug inside V8, the JavaScript and WebAssembly engine that powers Chrome. Type confusion occurs when code operates on a memory object while assuming an incorrect type. In V8, this typically arises when the optimizing compiler (TurboFan or Maglev) speculates on object shapes and fails to invalidate optimized code when the underlying type changes.

An attacker who hosts a crafted HTML page can deliver JavaScript that forces V8 to treat one object representation as another. The mismatch lets the attacker read or write outside the expected object layout, producing heap corruption. From this primitive, attackers commonly build arbitrary read/write capabilities and pivot to renderer code execution. Exploitation requires user interaction, namely visiting the malicious page.

Root Cause

The root cause is incorrect type assumptions in V8 when handling specific JavaScript object operations. The engine fails to validate that the runtime type of an operand matches the type assumed by generated or interpreted code paths. Details for the underlying bug are restricted in the Chromium Issue Tracker entry 377384894 while users update.

Attack Vector

The attack vector is network-based with user interaction. A victim must navigate to attacker-controlled content or load a malicious iframe, advertisement, or embedded HTML resource. No authentication or prior access to the host is required. Because the bug resides in the renderer, a sandbox escape would still be needed to fully compromise the host, but renderer-level code execution is sufficient to steal session data, mount further attacks against other Chromium components, and stage chained exploits.

No verified public proof-of-concept code is available. Technical details remain restricted pending broad patch adoption. Refer to the Chromium Issue Tracker entry and the Google Chrome Stable Update advisory for vendor information.

Detection Methods for CVE-2024-11395

Indicators of Compromise

Chrome renderer process crashes with signatures referencing V8 heap corruption, CHECK failures, or sandbox violations following navigation to untrusted sites.
Outbound connections from chrome.exe or its child renderer processes to newly registered or low-reputation domains shortly after page load.
Unexpected child processes spawned from Chrome renderer processes, indicating potential post-exploitation activity.

Detection Strategies

Inventory Chrome installations across endpoints and flag any version below 131.0.6778.85 as vulnerable.
Monitor browser process telemetry for anomalous renderer behavior, including memory access violations and unexpected JIT region writes.
Correlate web proxy logs with endpoint browser telemetry to identify users visiting pages associated with exploit kits or malvertising chains.

Monitoring Recommendations

Enable enterprise reporting via Chrome Browser Cloud Management to capture version data and crash reports across the fleet.
Forward endpoint and proxy telemetry into a centralized data lake to detect post-exploitation patterns such as renderer-initiated process creation.
Alert on Chrome installations that disable automatic updates or stay below the patched version for more than 48 hours.

How to Mitigate CVE-2024-11395

Immediate Actions Required

Update Google Chrome to version 131.0.6778.85 or later on all Windows, macOS, and Linux endpoints.
Restart Chrome after the update so the new binaries and V8 build load into memory.
Audit Chromium-based browsers and embedded frameworks (Electron, CEF) for downstream V8 updates and apply vendor patches as they become available.

Patch Information

Google addressed CVE-2024-11395 in the stable channel update announced on November 19, 2024. The fixed version is Chrome 131.0.6778.85 for Linux and 131.0.6778.85/.86 for Windows and macOS. Full release notes are available in the Chrome Releases blog.

Workarounds

Restrict browsing to trusted sites using enterprise web filtering until patches are deployed.
Enforce Site Isolation and ensure the renderer sandbox is enabled to limit the impact of a successful renderer compromise.
Disable or constrain JavaScript on untrusted origins via the DefaultJavaScriptSetting enterprise policy where business workflows allow.

bash

# Verify Chrome version on Linux/macOS endpoints
google-chrome --version

# Windows: query installed Chrome version from the registry
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv

# Example Chrome enterprise policy snippet to block JavaScript on untrusted origins
# /etc/opt/chrome/policies/managed/javascript_policy.json
{
  "DefaultJavaScriptSetting": 2,
  "JavaScriptAllowedForUrls": [
    "https://*.corp.example.com"
  ]
}