CVE-2024-12695: Google Chrome V8 RCE Vulnerability

CVE-2024-12695 Overview

CVE-2024-12695 is an out-of-bounds write vulnerability in the V8 JavaScript engine used by Google Chrome. The flaw affects Chrome versions prior to 131.0.6778.204. A remote attacker can execute arbitrary code inside the renderer sandbox by serving a crafted HTML page to a target user. Google rated the Chromium security severity as High and shipped a fix in the December 18, 2024 Stable channel update. The vulnerability is tracked under CWE-787 and carries an EPSS probability of 2.213% at the 84th percentile.

Critical Impact

Successful exploitation grants arbitrary code execution inside the Chrome renderer sandbox via a single visit to a malicious web page.

Affected Products

• Google Chrome on Desktop prior to 131.0.6778.204
• Chromium-based browsers embedding the vulnerable V8 build
• Applications using the affected V8 engine version

Discovery Timeline

• 2024-12-18 - Google releases Stable channel update fixing the issue
• 2024-12-18 - CVE-2024-12695 published to NVD
• 2025-02-11 - Last updated in NVD database

Technical Details for CVE-2024-12695

Vulnerability Analysis

The vulnerability resides in V8, the JavaScript and WebAssembly engine that Chrome uses to compile and execute code from web pages. V8 performs aggressive just-in-time (JIT) compilation and operates on typed memory regions where bounds checks must remain consistent with the engine's internal type assumptions. An out-of-bounds write [CWE-787] occurs when V8 writes data past the end of an allocated buffer or outside the intended object boundary.

Attackers exploit such conditions in V8 by crafting JavaScript that drives the optimizing compiler or runtime into an inconsistent state. Once an out-of-bounds write primitive is achieved, adversaries typically corrupt adjacent objects to build arbitrary read and write capabilities inside the renderer process. This leads to arbitrary code execution constrained by the Chrome sandbox. A separate sandbox escape would be required to reach the host operating system.

Root Cause

The root cause is a memory safety defect in V8 that permits writes outside the bounds of a managed object. Details are restricted in the Chromium Issue Tracker Entry pending broad patch adoption. The fix shipped with the Chrome Stable update documented in the Google Chrome Stable Update advisory.

Attack Vector

Exploitation requires the victim to load attacker-controlled HTML and JavaScript in a vulnerable Chrome build. The attacker hosts a malicious page or compromises a legitimate site, then delivers JavaScript that triggers the out-of-bounds write. No authentication is required, but user interaction in the form of navigation to the page is necessary. Common delivery channels include phishing emails, malvertising, and watering-hole attacks.

No public proof-of-concept or exploit code has been verified for this CVE. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. See the Chromium Issue Tracker Entry for technical details.

Detection Methods for CVE-2024-12695

Indicators of Compromise

• Chrome renderer process crashes referencing V8 in chrome_child.dll or libv8.so around the time of suspicious browsing activity.
• Outbound connections from chrome.exe to recently registered or low-reputation domains hosting heavy JavaScript payloads.
• Unexpected child processes spawned from the Chrome renderer following navigation to an untrusted site.

Detection Strategies

• Inventory installed Chrome versions across the fleet and flag any host running a build older than 131.0.6778.204.
• Monitor browser telemetry for renderer crash dumps containing V8 stack frames, which can indicate exploitation attempts.
• Correlate web proxy logs against threat intelligence feeds for known exploit-hosting infrastructure targeting Chromium engines.

Monitoring Recommendations

• Enable centralized collection of Chrome crash reports and review for anomalous V8 termination patterns.
• Track process lineage where chrome.exe is the parent of unexpected binaries or shell interpreters.
• Alert on Chrome installations that fail to update beyond the vulnerable version within the organizational patch SLA.

How to Mitigate CVE-2024-12695

Immediate Actions Required

• Update Google Chrome to version 131.0.6778.204 or later on Windows, macOS, and Linux endpoints.
• Update all Chromium-based browsers, such as Microsoft Edge, Brave, Opera, and Vivaldi, to releases that incorporate the patched V8.
• Force-restart Chrome processes after the update so the new V8 binary loads in active browsing sessions.

Patch Information

Google released the fix in the Stable channel update published December 18, 2024. Apply Chrome 131.0.6778.204 or later as documented in the Google Chrome Stable Update advisory. Enterprise administrators can deploy updates through Chrome Browser Cloud Management, Group Policy, or standard software distribution tooling.

Workarounds

• Restrict JavaScript execution on untrusted sites using Chrome enterprise policies such as DefaultJavaScriptSetting.
• Route browsing through a remote browser isolation service for high-risk user groups until patching is complete.
• Disable the V8 optimizer via the --js-flags="--no-opt" switch only where compatibility allows, as a temporary harm reduction step.

# Verify the deployed Chrome version meets the patched baseline
google-chrome --version
# Expected output: Google Chrome 131.0.6778.204 or later