CVE-2024-3833: Google Chrome WebAssembly RCE Vulnerability

CVE-2024-3833 Overview

CVE-2024-3833 is an object corruption vulnerability in the WebAssembly engine of Google Chrome versions prior to 124.0.6367.60. A remote attacker can exploit the flaw by serving a crafted HTML page that triggers corruption of internal V8 objects during WebAssembly execution. Successful exploitation can lead to arbitrary code execution within the renderer process and may be chained with sandbox escape vulnerabilities for full host compromise. The Chromium project rated the issue High severity, and Fedora 38, 39, and 40 shipped corresponding Chromium package updates.

Critical Impact

Remote attackers can corrupt WebAssembly objects via a malicious web page, enabling code execution in the Chrome renderer and a high impact to confidentiality, integrity, and availability.

Affected Products

• Google Chrome prior to 124.0.6367.60
• Fedora 38, 39, and 40 (Chromium package)
• Chromium-based browsers consuming the V8 engine before the patched release

Discovery Timeline

• 2024-04-16 - Google publishes the Stable Channel update for desktop addressing the issue
• 2024-04-17 - CVE-2024-3833 published to NVD
• 2024-12-19 - Last updated in NVD database

Technical Details for CVE-2024-3833

Vulnerability Analysis

The vulnerability resides in Chrome's WebAssembly implementation within the V8 JavaScript engine. WebAssembly (Wasm) executes low-level bytecode in the browser using just-in-time (JIT) compilation and tight integration with V8 object representations. An object corruption flaw means an attacker can manipulate the internal state of a JavaScript or Wasm object so that the engine misinterprets its type, layout, or backing store.

The weakness is categorized under [CWE-374] (Passing Mutable Objects to an Untrusted Method), reflecting a class of bugs where Wasm operations mutate objects whose invariants V8 assumes to be stable. Once those invariants break, subsequent property accesses or compiled code can read or write memory outside the intended bounds.

Exploitation typically yields a type confusion or out-of-bounds memory primitive inside the renderer process. From there, attackers build arbitrary read and write primitives and pivot to shellcode execution within the JIT region.

Root Cause

The root cause is improper handling of object state during WebAssembly operations in V8. The engine fails to fully validate or preserve object invariants when Wasm code interacts with JavaScript objects, allowing crafted bytecode and JavaScript sequences to leave V8 in an inconsistent state.

Attack Vector

The attack vector is network-based and requires user interaction. A victim must load a malicious HTML page hosting attacker-controlled JavaScript and WebAssembly modules. No authentication is required, and the page can be delivered through any standard web channel including malvertising, watering hole sites, or phishing links.

No verified public proof-of-concept is referenced in the advisory data. See the Chromium Issue Tracker Entry for restricted technical details once the embargo is lifted, and the Google Chrome Update Announcement for the official fix notice.

Detection Methods for CVE-2024-3833

Indicators of Compromise

• Chrome renderer process crashes referencing V8 or wasm frames in crash dumps shortly after visiting an unfamiliar site.
• Outbound connections from chrome.exe child processes to low-reputation domains immediately following page loads containing .wasm resources.
• Unexpected child processes spawned from Chrome renderer processes, indicating possible sandbox escape attempts following renderer compromise.

Detection Strategies

• Inventory Chrome installations across the fleet and flag any version below 124.0.6367.60 as vulnerable.
• Inspect proxy and DNS logs for HTML pages that load WebAssembly modules from newly registered or uncategorized domains.
• Correlate browser telemetry with EDR process-tree data to identify renderer-to-shell process transitions.

Monitoring Recommendations

• Forward Chrome crash reports and EDR process telemetry to a centralized analytics platform for behavioral baselining.
• Alert on renderer processes that load executable memory regions and then initiate network egress to non-Google infrastructure.
• Track patch compliance metrics for Chrome and Chromium-based browsers, including Fedora-packaged Chromium on Linux endpoints.

How to Mitigate CVE-2024-3833

Immediate Actions Required

• Update Google Chrome to version 124.0.6367.60 or later on all Windows, macOS, and Linux endpoints.
• Apply Fedora Chromium package updates referenced in the Fedora package announcements for releases 38, 39, and 40.
• Restart browser sessions after patching to ensure the vulnerable V8 binary is fully unloaded from memory.
• Audit managed Chromium-based browsers (Edge, Brave, Opera, Vivaldi) and apply vendor updates incorporating the same V8 fix.

Patch Information

Google addressed the flaw in the Stable Channel release 124.0.6367.60 for desktop. Refer to the Google Chrome Update Announcement for the full security bulletin. Fedora users should apply the Chromium updates distributed through the Fedora Package Announcement for affected releases.

Workarounds

• Enforce Chrome auto-update policies through enterprise management to prevent users from running outdated builds.
• Restrict access to untrusted websites through web filtering until all endpoints are confirmed patched.
• Disable WebAssembly via enterprise policy where business workflows do not require it, using the DefaultJavaScriptJitSetting and related policies as an interim hardening measure.

# Verify installed Chrome version on Linux endpoints
google-chrome --version

# Update Chromium on Fedora
sudo dnf upgrade --refresh chromium

# Enterprise policy snippet (Windows) to block JIT in Chrome as a temporary control
# HKLM\Software\Policies\Google\Chrome
# DefaultJavaScriptJitSetting = 2  (Disabled)