CVE-2024-2630: Google Chrome XSS Vulnerability

CVE-2024-2630 Overview

CVE-2024-2630 is a cross-origin data leak vulnerability in Google Chrome on iOS prior to version 123.0.6312.58. The flaw results from an inappropriate implementation in Chrome's iOS build that allows a remote attacker to leak cross-origin data via a crafted HTML page. Successful exploitation requires user interaction, such as visiting an attacker-controlled webpage. Google classified the Chromium security severity as Medium. The issue affects Google Chrome and downstream distributions including Fedora 38, 39, and 40.

Critical Impact
A remote attacker can leak sensitive cross-origin data from other web origins by luring a Chrome iOS user to a malicious HTML page, undermining the browser's same-origin policy protections.

Affected Products

Google Chrome on iOS prior to 123.0.6312.58
Fedora 38, 39, and 40 (Chromium packages)
Web applications relying on same-origin policy enforcement in Chrome iOS

Discovery Timeline

2024-03-20 - CVE-2024-2630 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-2630

Vulnerability Analysis

CVE-2024-2630 is categorized as an information disclosure issue involving cross-site scripting semantics [CWE-79]. The root problem is an inappropriate implementation within the iOS-specific Chrome code paths. This implementation weakness allows a crafted HTML page to bypass expected cross-origin boundaries and read data that should remain isolated to another origin. Because same-origin policy is a foundational browser security control, its bypass can expose authenticated session content, tokens, or user data rendered by third-party sites in the browser context.

Exploitation is remote and requires the target user to load attacker-controlled HTML. No privileges are required on the target device. The scope remains unchanged, and the attack impacts confidentiality only; integrity and availability are not directly affected.

Root Cause

The defect lives in Chrome's iOS port rather than the core Chromium rendering engine used on desktop platforms. Chrome on iOS is required by Apple's App Store rules to use WebKit, so the affected code involves the iOS-specific glue between Chrome UI and WebKit-backed web views. An inappropriate implementation in that layer failed to fully enforce cross-origin isolation when handling specific HTML constructs.

Attack Vector

An attacker hosts a specially crafted HTML page and induces a Chrome iOS user to visit it through phishing, malvertising, or an embedded link. Once loaded, the crafted markup and associated resources trigger the flawed code path, permitting the attacker's page to read data from a different origin loaded in the same browsing session.

No verified public proof-of-concept code is available for CVE-2024-2630.
Refer to the Chromium Issue Tracker entry 41481877 for restricted technical details:
https://issues.chromium.org/issues/41481877

Detection Methods for CVE-2024-2630

Indicators of Compromise

Chrome for iOS versions earlier than 123.0.6312.58 present on managed mobile devices
Outbound requests from mobile browsers to newly registered or low-reputation domains hosting crafted HTML
Unexpected cross-origin resource loads or iframe embeds referencing sensitive internal web applications
Fedora hosts running Chromium packages predating the vendor-released security update

Detection Strategies

Inventory Chrome iOS client versions through mobile device management (MDM) telemetry and flag installs below 123.0.6312.58.
Correlate proxy and DNS logs against threat intelligence feeds to identify user visits to suspected malicious HTML pages targeting mobile browsers.
Review web application logs for anomalous cross-origin Referer values or session token access patterns consistent with data exfiltration.

Monitoring Recommendations

Enable browser telemetry through your MDM or endpoint platform to track Chrome iOS version drift and patch compliance.
Monitor network egress from mobile devices for connections to domains flagged in phishing or malvertising campaigns.
Alert on Fedora package inventory that lacks the vendor-issued Chromium security update.

How to Mitigate CVE-2024-2630

Immediate Actions Required

Update Google Chrome for iOS to version 123.0.6312.58 or later on all managed devices through the Apple App Store or MDM policy.
Apply the Fedora Chromium security updates referenced in the Fedora package announcements for Fedora 38, 39, and 40.
Communicate risk to users and instruct them to avoid untrusted links until the update is confirmed installed.

Patch Information

Google addressed the issue in the Chrome Stable channel update announced on March 19, 2024. See the Google Chrome Update Announcement and the restricted Chromium Issue Tracker Entry. Fedora shipped corresponding Chromium packages documented in the Fedora Package Announcement, the Fedora Package Update Notice, and the Fedora Security Update Alert.

Workarounds

Enforce mandatory Chrome iOS updates through MDM configuration profiles to prevent version drift.
Restrict access to sensitive internal web applications from mobile browsers until affected clients are patched.
Deploy web isolation or secure web gateway policies that block known malicious HTML delivery domains.

bash

# Verify installed Chromium version on Fedora and update
rpm -q chromium
sudo dnf upgrade --refresh chromium

# For Chrome iOS, verify managed app version via MDM (example: Intune Graph API)
# GET https://graph.microsoft.com/beta/deviceAppManagement/mobileApps
# Filter for bundleId com.google.chrome.ios and confirm version >= 123.0.6312.58