CVE-2024-2887: Google Chrome WebAssembly RCE Vulnerability

CVE-2024-2887 Overview

CVE-2024-2887 is a Type Confusion vulnerability in the WebAssembly component of Google Chrome prior to version 123.0.6312.86. This vulnerability allows a remote attacker to execute arbitrary code via a crafted HTML page. The flaw was demonstrated at Pwn2Own Vancouver 2024, highlighting its severity and exploitability in real-world scenarios.

Critical Impact

This vulnerability enables remote code execution through maliciously crafted web content, potentially allowing attackers to gain control of affected systems when users visit compromised websites.

Affected Products

• Google Chrome versions prior to 123.0.6312.86
• Fedora 38, 39, and 40 (via bundled Chromium)
• Chromium-based browsers using vulnerable WebAssembly implementations

Discovery Timeline

• March 26, 2024 - CVE-2024-2887 published to NVD
• March 28, 2025 - Last updated in NVD database

Technical Details for CVE-2024-2887

Vulnerability Analysis

This vulnerability (CWE-843: Access of Resource Using Incompatible Type) stems from improper type handling within Chrome's WebAssembly engine. Type confusion vulnerabilities occur when a program allocates or initializes a resource as one type but later accesses it using an incompatible type, leading to memory corruption.

In the context of WebAssembly, the V8 JavaScript engine must properly validate and handle type information when executing WebAssembly modules. When type confusion occurs, the engine may misinterpret memory contents, allowing attackers to manipulate memory in ways the developers did not intend. This can result in arbitrary code execution within the browser's renderer process.

The vulnerability was successfully exploited at Pwn2Own Vancouver 2024, demonstrating that despite Chrome's sandbox architecture, sophisticated attackers can chain such vulnerabilities to achieve meaningful compromise of target systems.

Root Cause

The root cause lies in the WebAssembly implementation's handling of type information during execution. When processing certain WebAssembly constructs, the V8 engine fails to properly validate type consistency, allowing an attacker to craft WebAssembly code that triggers the type confusion condition. This leads to the engine treating memory regions as different types than originally allocated, corrupting internal data structures and enabling arbitrary code execution.

Attack Vector

The attack requires user interaction—specifically, a victim must navigate to an attacker-controlled or compromised web page containing the malicious HTML and WebAssembly payload. The attack is local to the system (requiring the browser to render the malicious content), though it is delivered remotely via the web. The attack complexity is high, requiring the attacker to craft a specific WebAssembly module that triggers the type confusion and chains it with additional techniques to achieve code execution.

The exploitation flow involves:

1. Victim visits a malicious or compromised website
2. The page loads a crafted WebAssembly module
3. The module triggers the type confusion during execution
4. Memory corruption enables arbitrary code execution within the renderer process

Due to the nature of this vulnerability, no verified proof-of-concept code is publicly available. Technical details can be found in the Zero Day Initiative Blog Post and the Chromium Issue Tracker Entry.

Detection Methods for CVE-2024-2887

Indicators of Compromise

• Unusual WebAssembly module loading from untrusted or newly registered domains
• Chrome renderer process crashes or unexpected behavior following WebAssembly execution
• Network connections to suspicious domains serving WebAssembly content (.wasm files)
• Browser memory corruption events or unexpected terminations

Detection Strategies

• Monitor for Chrome versions below 123.0.6312.86 in enterprise asset inventories
• Deploy endpoint detection rules that flag unusual WebAssembly compilation patterns
• Implement web proxy rules to inspect or log .wasm file downloads from untrusted sources
• Use browser extension policies to restrict WebAssembly execution on untrusted sites

Monitoring Recommendations

• Enable Chrome's Safe Browsing feature to detect malicious websites
• Configure centralized logging for browser crash reports and analyze for patterns
• Monitor DNS queries for suspicious domains associated with web-based attacks
• Implement SentinelOne Singularity to detect post-exploitation behaviors if the sandbox is bypassed

How to Mitigate CVE-2024-2887

Immediate Actions Required

• Update Google Chrome to version 123.0.6312.86 or later immediately
• Apply Fedora security updates for Chromium packages on Fedora 38, 39, and 40
• Verify all Chromium-based browsers in your environment are updated
• Consider temporarily disabling WebAssembly via browser policies until patching is complete

Patch Information

Google released a security update addressing this vulnerability on March 26, 2024. The fix is included in Chrome version 123.0.6312.86 and later. Organizations should reference the Google Chrome Desktop Update for official patch details. Fedora users should apply updates via the standard package management system, as documented in the Fedora Package Announcements.

Workarounds

• Disable WebAssembly in Chrome via enterprise policy: --disable-features=WebAssembly
• Use site isolation features to limit the impact of renderer compromise
• Implement strict Content Security Policy headers to restrict WebAssembly sources
• Deploy web filtering to block access to known malicious domains

# Chrome Enterprise Policy to disable WebAssembly (Windows Registry example)
reg add "HKLM\SOFTWARE\Policies\Google\Chrome" /v WebAssemblyEnabled /t REG_DWORD /d 0 /f

# Verify current Chrome version
google-chrome --version
# Expected: Google Chrome 123.0.6312.86 or higher