CVE-2024-4059: Google Chrome V8 API Information Disclosure

CVE-2024-4059 Overview

CVE-2024-4059 is an out-of-bounds read vulnerability [CWE-125] in the V8 JavaScript engine API used by Google Chrome. The flaw affects Chrome versions prior to 124.0.6367.78. A remote attacker can leak cross-site data by convincing a user to load a crafted HTML page. Chromium's security team rated the underlying issue as High severity, though the assigned CVSS base score reflects a confidentiality-only impact requiring user interaction. Fedora 40 is also affected because it ships the Chromium package downstream.

Critical Impact
A crafted HTML page can trigger an out-of-bounds read in the V8 API, allowing a remote attacker to leak cross-site data from the browser process.

Affected Products

Google Chrome versions prior to 124.0.6367.78
Fedora 40 (Chromium package)
Chromium-based downstream distributions bundling vulnerable V8 builds

Discovery Timeline

2024-05-01 - CVE-2024-4059 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-4059

Vulnerability Analysis

The vulnerability resides in the V8 API, the interface layer that C++ embedder code (Chrome's renderer and browser process bindings) uses to interact with the V8 JavaScript engine. An attacker-controlled HTML page can craft JavaScript that induces the API to read memory outside the bounds of an allocated object. The read data is then observable back to the attacker's script context, producing a cross-origin information leak. Because the read occurs across security contexts, an attacker can extract data from other origins loaded in the same renderer or shared process memory.

Root Cause

The root cause is missing or incorrect bounds validation within a V8 API call path. When embedder code passes indices or sizes that the API assumes are within valid ranges, V8 accesses memory beyond the intended buffer. This is a classic out-of-bounds read [CWE-125] rather than a memory-corruption write. It produces an information disclosure primitive rather than direct control-flow hijack.

Attack Vector

Exploitation requires a victim to visit an attacker-controlled or compromised web page. No authentication or elevated privileges are needed on the target. The attacker supplies JavaScript inside the HTML page that reaches the vulnerable V8 API path and reads adjacent memory. The leaked bytes can include cross-site content, tokens, or memory layout information useful for chaining with other browser vulnerabilities.

No verified public proof-of-concept code is available for this CVE. Refer to the Chromium Issue Tracker #333182464 for technical details once access is granted by Google.

Detection Methods for CVE-2024-4059

Indicators of Compromise

Chrome or Chromium browsers reporting installed versions below 124.0.6367.78 in inventory data
Renderer process crashes referencing V8 API frames following visits to untrusted pages
Outbound connections to newly registered or low-reputation domains hosting heavily obfuscated JavaScript

Detection Strategies

Query endpoint inventory for Chrome version strings and flag hosts below the patched build
Correlate browser crash telemetry with browsing history to identify pages triggering V8 faults
Inspect HTTP responses in web proxy logs for pages combining unusual ArrayBuffer, TypedArray, or WebAssembly patterns with cross-origin resource loads

Monitoring Recommendations

Ingest browser process telemetry and Windows Error Reporting or macOS crash reports into a centralized data lake for version and crash correlation
Track DNS and TLS SNI logs for repeat visits to domains associated with malicious JavaScript campaigns
Alert on unpatched Chrome installations older than 30 days after a Stable channel release

How to Mitigate CVE-2024-4059

Immediate Actions Required

Update Google Chrome to version 124.0.6367.78 or later on all managed endpoints
Update Fedora 40 Chromium packages using the referenced Fedora advisories
Restart the browser after patching to ensure the vulnerable V8 build is unloaded from memory
Verify version compliance through endpoint management tooling before closing the remediation ticket

Patch Information

Google released the fix in the Stable channel update announced in the Google Chrome Desktop Update. Fedora shipped corresponding Chromium updates through the Fedora Package Announcement #1, Fedora Package Announcement #2, and Fedora Package Announcement #3.

Workarounds

Enforce browser auto-update policies through group policy or MDM to prevent version drift
Restrict access to untrusted websites using web proxy category filtering until patches are deployed fleet-wide
Deploy site isolation and strict Cross-Origin-Opener-Policy (COOP) and Cross-Origin-Embedder-Policy (COEP) headers on internal applications to limit cross-origin leakage impact

bash

# Verify installed Chrome version on Linux endpoints
google-chrome --version

# Update Chromium on Fedora 40
sudo dnf upgrade --refresh chromium

# Confirm the fixed build is at least 124.0.6367.78