CVE-2024-4947: Google Chrome V8 RCE Vulnerability

CVE-2024-4947 Overview

CVE-2024-4947 is a type confusion vulnerability in the V8 JavaScript engine used by Google Chrome. The flaw affects Chrome versions prior to 125.0.6422.60 and allows a remote attacker to execute arbitrary code inside the renderer sandbox through a crafted HTML page. Google addressed the issue in the Stable Channel update released on May 15, 2024. CISA added CVE-2024-4947 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. The weakness is classified under [CWE-843: Access of Resource Using Incompatible Type ('Type Confusion')].

Critical Impact
Remote attackers can achieve arbitrary code execution inside the Chrome renderer sandbox by luring a user to a malicious web page, enabling browser compromise and a foothold for sandbox escape chains.

Affected Products

Google Chrome versions prior to 125.0.6422.60
Fedora 38, 39, and 40 (chromium packages)
Chromium-based browsers consuming the upstream V8 engine

Discovery Timeline

2024-05-15 - Google releases the Stable Channel update fixing the issue
2024-05-15 - CVE-2024-4947 published to NVD
2025-10-24 - Last updated in NVD database

Technical Details for CVE-2024-4947

Vulnerability Analysis

The vulnerability resides in V8, the JavaScript and WebAssembly engine that powers Chrome. V8 uses speculative type assumptions and inline caches to optimize hot code paths. When the engine treats an object as one type while the underlying memory actually holds another, the resulting type confusion bypasses safety checks during property access and method dispatch.

An attacker who controls the JavaScript executed in a tab can force V8 to operate on an object as if it had a different shape or class. This mismatched view enables reading and writing memory outside the intended bounds of the original object. Adversaries chain such primitives into arbitrary read/write capabilities, then pivot to native code execution inside the renderer process.

Because the renderer is sandboxed, this single bug yields code execution constrained to the sandbox. In real-world campaigns, attackers pair V8 type confusion bugs with a second sandbox-escape flaw to achieve full host compromise. CISA's KEV listing reflects observed exploitation in targeted attacks.

Root Cause

The root cause is an incompatible type assumption inside V8 [CWE-843]. The engine assumed an object conformed to one internal representation while operations on it were valid only for a different representation, leading to memory access using the wrong type signature.

Attack Vector

Exploitation requires a victim to visit attacker-controlled or compromised web content. The crafted HTML page delivers JavaScript that triggers the type confusion path in V8. No authentication or special privileges are required, and exploitation occurs entirely over the network. See the Chromium Issue Tracker Entry for upstream details.

No verified public proof-of-concept code is available for CVE-2024-4947.
Refer to the Chromium issue tracker and Google advisory for technical details.

Detection Methods for CVE-2024-4947

Indicators of Compromise

Chrome renderer process spawning unexpected child processes such as command shells or scripting hosts
Unexplained outbound connections from chrome.exe to newly registered or low-reputation domains immediately after page load
Crash reports referencing V8 type assertions on hosts running Chrome builds older than 125.0.6422.60
Browser cache or download artifacts containing obfuscated JavaScript that targets V8 internals like Map transitions or hidden classes

Detection Strategies

Inventory installed Chrome and Chromium-based browser versions across the fleet and flag any build prior to 125.0.6422.60
Hunt for renderer-to-parent privilege escalation behavior, including renderer processes writing to autorun locations or loading unsigned modules
Inspect proxy and DNS telemetry for HTML pages that serve large, heavily obfuscated JavaScript followed by binary payload downloads to user profile directories

Monitoring Recommendations

Forward browser process telemetry (process creation, module loads, network connections) to a centralized analytics platform for behavioral correlation
Subscribe to the Google Chrome Update Announcement feed and the CISA Known Exploited Vulnerability catalog for status changes
Alert on Chrome crash dumps tagged with V8 fatal errors, which can indicate exploitation attempts that failed mid-chain

How to Mitigate CVE-2024-4947

Immediate Actions Required

Update Google Chrome to version 125.0.6422.60 or later on Windows, macOS, and Linux endpoints
Patch downstream Chromium-based browsers (Edge, Brave, Opera, Vivaldi) to versions that incorporate the V8 fix
Apply Fedora chromium updates referenced in the Fedora Package Announcement for Fedora 38, 39, and 40
Restart browser sessions after updating to ensure the patched V8 binary is loaded

Patch Information

Google shipped the fix in Chrome 125.0.6422.60 on the Stable Channel. The release notes are documented in the Google Chrome Update Announcement. Fedora packagers issued updated chromium builds via the Fedora Updates System.

Workarounds

Enforce automatic Chrome updates through enterprise policy so that critical V8 fixes deploy without user action
Restrict browsing to vetted sites via web filtering or isolation for users who cannot immediately patch
Disable JavaScript on untrusted origins through Chrome policies where feasible, accepting the functionality trade-off

bash

# Verify the installed Chrome version meets or exceeds the patched build
google-chrome --version

# Fedora: update chromium to the patched package
sudo dnf upgrade --refresh chromium