CVE-2024-5158 Overview
CVE-2024-5158 is a type confusion vulnerability in the V8 JavaScript engine used by Google Chrome prior to version 125.0.6422.76. The flaw allows a remote attacker to potentially perform arbitrary memory read and write operations by serving a crafted HTML page to a target user. Chromium rates the security severity as High. The issue is tracked under [CWE-843] (Access of Resource Using Incompatible Type). Fedora 39 and Fedora 40 distributions shipping affected Chrome packages are also impacted.
Critical Impact
A remote attacker who convinces a user to visit a crafted page can achieve arbitrary read/write within the renderer process, enabling sandboxed code execution and a starting point for further exploitation.
Affected Products
- Google Chrome versions prior to 125.0.6422.76
- Fedora Project Fedora 39
- Fedora Project Fedora 40
Discovery Timeline
- 2024-05-22 - CVE-2024-5158 published to NVD
- 2024-12-19 - Last updated in NVD database
Technical Details for CVE-2024-5158
Vulnerability Analysis
The vulnerability is a type confusion condition in V8, the JavaScript and WebAssembly engine that powers Chrome. Type confusion occurs when code assumes an object is of one type while it is actually another, causing the engine to interpret memory layouts incorrectly. In V8, such mismatches typically arise from optimizations performed by the TurboFan or Maglev compilers, where assumptions about object shapes (hidden classes/Maps) become invalid after script-driven state changes.
When the engine acts on the wrong type, attacker-controlled data is treated as pointers or metadata. This primitive enables out-of-bounds memory access in the renderer process, which translates directly into arbitrary read and write of process memory. Attackers chain this primitive with sandbox-aware techniques to manipulate JavaScript objects, leak addresses, and corrupt critical structures.
Root Cause
The root cause is an incorrect type assumption in V8 during execution of JavaScript that exercises a specific optimization path. The engine fails to validate object types consistently, allowing a crafted sequence of operations to coerce mismatched type interpretations. Details are tracked in the Chromium Issue Tracker entry.
Attack Vector
Exploitation requires the victim to load attacker-controlled HTML and JavaScript in a vulnerable Chrome build. No authentication is required, but user interaction (visiting a page or clicking a link) is needed. Successful exploitation yields arbitrary read/write inside the renderer, which attackers can combine with separate sandbox-escape vulnerabilities to achieve broader code execution on the host.
No public proof-of-concept or exploit module is currently associated with this CVE in public databases. The EPSS score is 0.61% (percentile 44.369).
Detection Methods for CVE-2024-5158
Indicators of Compromise
- Chrome renderer process crashes referencing V8 type assertions, CHECK failures, or DCHECK violations in crash logs.
- Unexpected child process creation from chrome.exe or chrome renderer processes following web browsing activity.
- Outbound connections from browser processes to uncategorized or newly registered domains hosting heavy JavaScript payloads.
- Endpoints running Chrome versions earlier than 125.0.6422.76 identified during software inventory scans.
Detection Strategies
- Inventory installed browser versions across the fleet and flag any Chrome instance below 125.0.6422.76.
- Monitor crash telemetry for repeated V8 or renderer crashes, which often precede or follow exploitation attempts.
- Correlate web proxy logs with endpoint process telemetry to identify renderers spawning unexpected child processes after page loads.
Monitoring Recommendations
- Enable browser crash reporting and ingest reports into the SIEM for anomaly review.
- Track Chrome update compliance through configuration management and group policy reporting.
- Alert on Chrome renderer processes performing file writes outside standard cache and profile directories.
How to Mitigate CVE-2024-5158
Immediate Actions Required
- Update Google Chrome to version 125.0.6422.76 or later on all Windows, macOS, and Linux endpoints.
- Apply the Fedora 39 and Fedora 40 package updates referenced in the Fedora package announcements.
- Force-restart Chrome after updates to ensure the patched binary is active in all user sessions.
- Audit managed browser policies to confirm automatic updates are enabled and not blocked by enterprise configuration.
Patch Information
Google released the fix in the Stable channel update announced on May 21, 2024. Refer to the Google Chrome Desktop Update advisory for full version details. Fedora users should consult the Fedora package announcements (FEDORA-2024-5KEVD4433K and FEDORA-2024-FX6IYZ6XF7) for the corresponding chromium package updates.
Workarounds
- Restrict browsing to trusted sites via web filtering or DNS policy until patches are deployed.
- Enable Chrome Site Isolation and Enhanced Safe Browsing to raise the cost of renderer-based exploitation.
- Use application allowlisting to prevent unauthorized child processes from spawning out of the browser.
# Verify installed Chrome version on Linux
google-chrome --version
# Update Chromium on Fedora
sudo dnf update chromium
# Windows: force Chrome update check via command line
"%ProgramFiles%\Google\Chrome\Application\chrome.exe" --check-for-update-interval=1
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
