CVE-2024-1675: Google Chrome Auth Bypass Vulnerability

CVE-2024-1675 Overview

CVE-2024-1675 is a security flaw in Google Chrome's Download component caused by insufficient policy enforcement. Versions prior to 122.0.6261.57 allow a remote attacker to bypass filesystem restrictions through a crafted HTML page. The Chromium project classified the underlying defect at Medium severity, while the National Vulnerability Database (NVD) assigned a higher score reflecting broader impact assumptions. The weakness is categorized under CWE-284: Improper Access Control. Successful exploitation requires user interaction, typically through visiting an attacker-controlled web page. The vulnerability affects Google Chrome on all supported platforms and downstream distributions such as Fedora 38 and Fedora 39.

Critical Impact
A remote attacker who lures a user to a crafted page can bypass Chrome's download filesystem restrictions, potentially writing files to locations that should be protected.

Affected Products

Google Chrome versions prior to 122.0.6261.57
Fedora 38 (chromium package)
Fedora 39 (chromium package)

Discovery Timeline

2024-02-21 - CVE-2024-1675 published to NVD
2025-03-14 - Last updated in NVD database

Technical Details for CVE-2024-1675

Vulnerability Analysis

The flaw resides in Chrome's Download subsystem, which enforces policies governing where and how files retrieved from the web may be written to the local filesystem. Insufficient policy enforcement means that certain code paths fail to consistently validate download targets against the browser's security boundaries. A remote attacker can craft an HTML page that triggers a download flow circumventing these restrictions. The result is the ability to influence file placement beyond what Chrome's sandbox and download policies normally permit. Because the issue requires the user to interact with the malicious page, the attack typically begins with phishing, malvertising, or a compromised website.

Root Cause

The root cause is improper access control [CWE-284] within the download handling logic. Chrome's policy checks do not cover every path through which a download can be initiated and finalized. Specific exploitation details have not been disclosed by Google, consistent with Chromium's policy of withholding technical specifics until a majority of users have updated. The Chromium Issue Tracker entry remains the canonical reference.

Attack Vector

Exploitation is network-based and requires user interaction. An attacker hosts a crafted HTML page that initiates a download sequence designed to evade Chrome's filesystem restrictions. When a victim visits the page using a vulnerable Chrome build, the download policy bypass occurs without explicit prompts that would normally alert the user. The vulnerability is described in prose only because no verified public proof-of-concept exists at the time of writing. See the Google Chrome Stable Update advisory for vendor commentary.

Detection Methods for CVE-2024-1675

Indicators of Compromise

Unexpected files written to sensitive user directories such as Startup folders, browser profile directories, or shell auto-run locations shortly after Chrome browsing activity.
Chrome download history entries showing files saved to paths outside the configured default download directory.
Outbound HTTPS connections to newly registered or low-reputation domains immediately followed by file creation events on disk.

Detection Strategies

Inventory installed Chrome versions across the fleet and flag any build earlier than 122.0.6261.57 as vulnerable.
Correlate browser process file-write events with the originating URL to identify downloads that bypass standard prompts.
Hunt for child processes spawned from files created by chrome.exe in non-standard locations.

Monitoring Recommendations

Forward Chrome telemetry and endpoint file-creation events to a centralized analytics platform for retroactive hunting once exploitation patterns become public.
Monitor for execution of binaries dropped into user-writable persistence locations following web browsing sessions.
Track Chrome version compliance through endpoint management tooling and alert on regressions to vulnerable builds.

How to Mitigate CVE-2024-1675

Immediate Actions Required

Update Google Chrome to version 122.0.6261.57 or later on all Windows, macOS, and Linux endpoints.
Apply the corresponding Fedora chromium updates on Fedora 38 and Fedora 39 systems.
Restart the browser after updating to ensure the patched binary is loaded into all running sessions.

Patch Information

Google released the fix in the Chrome Stable channel update published on February 20, 2024. Full vendor details are available in the Google Chrome Stable Update advisory. Fedora users should consult the Fedora 38 package announcement and Fedora 39 package announcement for distribution-specific package versions.

Workarounds

Enforce automatic Chrome updates through enterprise policy so that critical patches reach endpoints without user action.
Restrict download destinations using the DownloadDirectory and DownloadRestrictions enterprise policies to limit where files can be written.
Apply application allowlisting on endpoints to prevent execution of binaries written to user-writable paths.

bash

# Verify Chrome version on Linux endpoints
google-chrome --version

# Update Fedora chromium package
sudo dnf update chromium

# Example Windows enterprise policy registry key to restrict downloads
# HKLM\Software\Policies\Google\Chrome\DownloadRestrictions = 3