CVE-2024-12693: Google Chrome V8 RCE Vulnerability

CVE-2024-12693 Overview

CVE-2024-12693 is an out-of-bounds memory access vulnerability in the V8 JavaScript engine used by Google Chrome. The flaw affects Chrome versions prior to 131.0.6778.204. A remote attacker can exploit the issue by serving a crafted HTML page that triggers arbitrary code execution within the Chrome renderer sandbox. Google classified the Chromium security severity as High. The weakness maps to CWE-787 (Out-of-bounds Write) and CWE-125 (Out-of-bounds Read).

Critical Impact
Remote attackers can execute arbitrary code inside the Chrome renderer sandbox by luring a user to a crafted web page, enabling downstream sandbox escape and full compromise chains.

Affected Products

Google Chrome versions prior to 131.0.6778.204 on desktop platforms
Chromium-based browsers embedding the vulnerable V8 build
Applications shipping the affected V8 engine as a component

Discovery Timeline

2024-12-18 - Google publishes stable channel update fixing the flaw
2024-12-18 - CVE-2024-12693 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-12693

Vulnerability Analysis

The vulnerability resides in V8, the JavaScript and WebAssembly engine that powers Chrome. V8 performs aggressive just-in-time (JIT) compilation and speculative optimizations on hot JavaScript functions. When an optimizer misjudges an object's shape, element kind, or numeric range, generated machine code can read or write past the intended buffer boundary. That out-of-bounds access enables an attacker to corrupt adjacent objects in the V8 heap and construct arbitrary read/write primitives. From there, an attacker gains code execution inside the sandboxed renderer process. Exploitation requires user interaction, typically visiting a malicious page or an attacker-controlled iframe on a compromised site.

Root Cause

The root cause is improper bounds handling in V8 that leads to out-of-bounds memory access, covering both [CWE-787] and [CWE-125] conditions. Google has not published implementation-level details, consistent with Chrome's disclosure practice while users update. Reference material is limited to the Chromium issue tracker entry, which remains restricted.

Attack Vector

The attack requires a network-reachable web page and user interaction. An attacker hosts a crafted HTML document containing JavaScript that coerces V8 into the vulnerable code path. Delivery mechanisms include drive-by downloads, malicious advertising, watering-hole compromises, and phishing links. Successful exploitation yields code execution inside the renderer sandbox. Attackers typically chain such flaws with a sandbox escape to achieve full host compromise. Because Chrome and Chromium-based browsers share V8, embedded browsers and Electron applications inherit the risk until the underlying V8 is patched.

Detection Methods for CVE-2024-12693

Indicators of Compromise

Chrome renderer processes spawning unexpected child processes such as cmd.exe, powershell.exe, or shells on macOS and Linux
Renderer processes writing executables or scripts to user-writable paths like %TEMP%, %APPDATA%, or /tmp
Outbound connections from chrome.exe to newly registered or low-reputation domains immediately after browsing activity
Browser crash telemetry citing V8 access violations aligned with visits to untrusted pages

Detection Strategies

Inventory installed Chrome and Chromium-derived browser versions and flag any build below 131.0.6778.204
Alert on process lineage where chrome.exe (or Google Chrome Helper (Renderer)) is the parent of shell interpreters, script hosts, or LOLBins
Correlate browser crash dumps with subsequent process creation or persistence events on the same host
Ingest browser telemetry and proxy logs into a SIEM to hunt for repeat visits to domains hosting exploit kits

Monitoring Recommendations

Monitor endpoint EDR telemetry for renderer sandbox escapes and unusual memory allocation patterns in chrome.exe
Track browser update compliance across managed fleets and enforce automatic updates through group policy or MDM
Review web proxy and DNS logs for connections to malvertising infrastructure and known exploit-delivery domains

How to Mitigate CVE-2024-12693

Immediate Actions Required

Update Google Chrome to version 131.0.6778.204 or later on Windows, macOS, and Linux endpoints
Force-restart Chrome after deployment so the patched V8 binary is loaded in memory
Update Chromium-based browsers (Edge, Brave, Opera, Vivaldi) once their vendors ship builds incorporating the fixed V8
Patch Electron and CEF-based applications that embed the vulnerable V8 engine

Patch Information

Google released the fix in the Chrome Stable channel update on December 18, 2024. Refer to the Google Chrome Stable Update advisory for release details. Technical background is tracked in the restricted Chromium Issue Tracker Entry.

Workarounds

No official workaround exists; patching is the only supported remediation
Disable JavaScript for untrusted sites through Chrome site settings to reduce exposure until updates apply
Restrict browsing to trusted domains via web proxy allowlists on high-risk endpoints
Enforce site isolation and the strictest available sandbox policies through enterprise Chrome policies

bash

# Verify installed Chrome version on Windows
reg query "HKLM\SOFTWARE\WOW6432Node\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv

# Verify installed Chrome version on macOS
defaults read /Applications/Google\ Chrome.app/Contents/Info CFBundleShortVersionString

# Verify installed Chrome version on Linux
google-chrome --version