CVE-2024-5840: Google Chrome CORS Policy Bypass Vulnerability

CVE-2024-5840 Overview

CVE-2024-5840 is a Cross-Origin Resource Sharing (CORS) policy bypass in Google Chrome versions prior to 126.0.6478.54. A remote attacker can bypass discretionary access control by convincing a user to visit a crafted HTML page. Google's Chromium team rated the underlying issue as Medium severity. The flaw is tracked upstream as Chromium Issue #41492103 and is categorized under [CWE-284] Improper Access Control. Fedora shipped corresponding Chromium updates for Fedora 39 and Fedora 40.

Critical Impact
A successful attack allows an attacker-controlled page to bypass the browser's same-origin policy enforcement, enabling unauthorized cross-origin interactions that can lead to data integrity impact on affected origins.

Affected Products

Google Chrome versions prior to 126.0.6478.54
Fedora 39 (Chromium package)
Fedora 40 (Chromium package)

Discovery Timeline

2024-06-11 - CVE-2024-5840 published to NVD following the Chrome Stable channel update
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-5840

Vulnerability Analysis

The vulnerability resides in Chrome's Cross-Origin Resource Sharing (CORS) implementation. CORS is the browser mechanism that decides when a script running on origin A is allowed to read responses from origin B. When the mechanism is bypassed, the browser's discretionary access control between origins no longer functions as designed.

Because the flaw is a policy bypass rather than a memory corruption issue, exploitation does not require crashing or corrupting the renderer. Instead, an attacker crafts an HTML page that manipulates request or response handling so the browser applies incorrect CORS decisions. The result is unauthorized access or modification of cross-origin data that the origin's server intended to restrict.

The issue affects the integrity of protected resources rather than their confidentiality directly, and requires user interaction to load the malicious page.

Root Cause

The root cause is improper access control ([CWE-284]) in Chrome's CORS enforcement path prior to 126.0.6478.54. Chromium's issue tracker entry #41492103 restricts detailed technical disclosure while users update. The Chromium security team classified the underlying defect as Medium severity.

Attack Vector

Exploitation requires a victim to load an attacker-controlled HTML page in a vulnerable Chrome build. No authentication or elevated privileges are required on the target system. Once loaded, the crafted page issues cross-origin requests that abuse the CORS policy weakness to interact with other origins in ways the browser should have blocked.

The vulnerability manifests entirely in the browser process; there is no verified public proof-of-concept, no CISA KEV listing, and no evidence of exploitation in the wild. See the Chromium Issue Tracker entry for the authoritative technical reference.

Detection Methods for CVE-2024-5840

Indicators of Compromise

Chrome browser processes running versions earlier than 126.0.6478.54 after the June 2024 stable channel update
Web proxy or browser telemetry showing unexpected cross-origin requests from user-navigated pages to sensitive internal origins
Fedora 39 or Fedora 40 hosts with Chromium packages predating the fixes referenced in the Fedora package announcements

Detection Strategies

Inventory installed Chrome versions across the fleet and flag any build older than 126.0.6478.54
Monitor egress web traffic for suspicious cross-origin request patterns targeting internal applications from external referrers
Correlate browser version telemetry with visits to newly registered or low-reputation domains hosting crafted HTML content

Monitoring Recommendations

Enable centralized browser version reporting through enterprise browser management or endpoint inventory tooling
Alert on Chromium package versions on Linux endpoints that fall behind distribution security advisories
Track browsing to untrusted domains and inspect requests that carry sensitive cookies or authentication headers cross-origin

How to Mitigate CVE-2024-5840

Immediate Actions Required

Update Google Chrome to 126.0.6478.54 or later on all Windows, macOS, and Linux endpoints
Update Chromium on Fedora 39 and Fedora 40 hosts using dnf upgrade to pull the fixed packages
Restart the browser after updating to ensure the patched binary is loaded across all user sessions
Verify version compliance by checking chrome://settings/help or querying package versions in configuration management tools

Patch Information

Google addressed CVE-2024-5840 in the Chrome Stable channel update announced on the Chrome Releases blog. The fix is included in Chrome 126.0.6478.54 and later. Fedora shipped corresponding Chromium updates documented in the Fedora 39 advisory and the Fedora 40 advisory.

Workarounds

No vendor-supplied workaround exists; applying the patched build is the only supported remediation
Restrict user browsing to trusted sites through enterprise web filtering until updates are deployed
Enforce automatic Chrome updates through group policy or MDM to reduce the exposure window for future browser CVEs

bash

# Verify Chrome is patched on Linux
google-chrome --version

# Update Chromium on Fedora
sudo dnf upgrade --refresh chromium

# Query installed Chrome version on Windows via PowerShell
(Get-Item "$env:ProgramFiles\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion