CVE-2024-3845: Google Chrome Mixed Content Policy Bypass

CVE-2024-3845 Overview

CVE-2024-3845 is a mixed content policy bypass in the Networks component of Google Chrome. The flaw affects Chrome versions prior to 124.0.6367.60 and is classified under [CWE-358] (Improperly Implemented Security Check for Standard). A remote attacker can bypass browser mixed content restrictions by serving a crafted HTML page. Chromium rates the underlying security severity as Low, while the assigned CVSS 3.1 score reflects a limited integrity impact requiring user interaction. Exploitation requires the victim to visit an attacker-controlled page. Chromium tracked the underlying defect as internal issue 323583084.

Critical Impact
Successful exploitation lets a remote attacker load insecure subresources on HTTPS pages, weakening transport security guarantees and enabling downgrade or content-tampering scenarios.

Affected Products

Google Chrome prior to 124.0.6367.60
Fedora 38, 39, and 40 (chromium package)
Chromium-based downstream browsers that had not integrated the M124 network stack fix

Discovery Timeline

2024-04-16 - Google releases the Chrome Stable channel update addressing the issue
2024-04-17 - CVE-2024-3845 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-3845

Vulnerability Analysis

The vulnerability resides in Chrome's Networks component, which enforces the browser's mixed content policy. Mixed content policy blocks HTTPS pages from loading resources served over insecure HTTP. Chrome's inappropriate implementation allows an attacker to craft an HTML page that circumvents this restriction. The bypass affects integrity of the page context rather than confidentiality or availability, per the CVSS vector. Because user interaction is required, exploitation depends on convincing a victim to load attacker-controlled markup. Fedora shipped downstream chromium updates through multiple package announcements across Fedora 38, 39, and 40 to align with the upstream Chrome 124.0.6367.60 fix.

Root Cause

The root cause is an improperly implemented standard security check ([CWE-358]) within the Chrome network stack. The mixed content enforcement logic fails to correctly classify certain subresource requests originating from crafted markup. As a result, requests that should be blocked or upgraded to HTTPS are permitted to proceed over insecure transport.

Attack Vector

An attacker hosts a crafted HTML page and lures a victim to visit it, typically via phishing, a compromised site, or malvertising. When the victim's Chrome browser renders the page, the flawed check permits insecure subresources to load in an otherwise secure context. This creates opportunities for adversary-in-the-middle content tampering, script substitution, or leakage of context that relies on transport integrity. No credentials or elevated privileges are required from the attacker's side. No public proof-of-concept has been published, and the vulnerability is not listed in the CISA KEV catalog.

No verified exploit code is publicly available. See the Chromium Issue #323583084 and the Google Chrome Stable Update for upstream references.

Detection Methods for CVE-2024-3845

Indicators of Compromise

Chrome browser instances reporting a version string below 124.0.6367.60 in user-agent telemetry or endpoint inventory.
Outbound HTTP requests originating from browser processes to non-HTTPS hosts referenced by HTTPS parent pages.
Web proxy logs showing mixed-content subresource loads that should have been blocked by policy.

Detection Strategies

Inventory browser versions across the fleet and flag hosts still running Chrome or Chromium builds earlier than 124.0.6367.60.
Correlate DNS and HTTP proxy telemetry to detect HTTPS pages triggering insecure subresource fetches on outdated browsers.
Monitor endpoint process telemetry for chrome.exe or chromium child processes initiating cleartext HTTP connections tied to browsing sessions on sensitive sites.

Monitoring Recommendations

Enable centralized browser management (Chrome Browser Cloud Management or equivalent) to report installed versions in near real time.
Alert on Fedora hosts missing the chromium updates referenced in the Fedora package announcements.
Track EPSS drift for CVE-2024-3845 to reprioritize remediation if exploitation likelihood increases.

How to Mitigate CVE-2024-3845

Immediate Actions Required

Update Google Chrome to 124.0.6367.60 or later on Windows, macOS, and Linux endpoints.
Apply the corresponding Fedora chromium package updates on Fedora 38, 39, and 40 hosts.
Restart browser sessions after update to ensure the patched binary is loaded into memory.

Patch Information

Google addressed the flaw in the Chrome Stable channel release announced on April 16, 2024. Details are documented in the Google Chrome Stable Update advisory and the underlying Chromium Issue #323583084. Fedora rebuilt and shipped patched chromium packages via multiple package-announce messages.

Workarounds

Enforce enterprise Chrome policies that block or strictly warn on mixed content (InsecureContentAllowedForUrls left unset; StrictMixedContentCheckingEnabled enabled where supported).
Restrict browsing of untrusted HTML content on unpatched hosts and route traffic through a filtering proxy that upgrades or blocks HTTP subresources.
Deploy HTTP Strict Transport Security (HSTS) preload lists and Content Security Policy upgrade-insecure-requests directives on internally operated web properties.

bash

# Verify Chrome version on Linux endpoints
google-chrome --version

# Update chromium on Fedora
sudo dnf upgrade --refresh chromium

# Confirm the installed package version
rpm -q chromium