CVE-2024-6100: Google Chrome V8 Type Confusion RCE Flaw

CVE-2024-6100 Overview

CVE-2024-6100 is a type confusion vulnerability in the V8 JavaScript engine used by Google Chrome versions prior to 126.0.6478.114. A remote attacker can exploit the flaw by serving a crafted HTML page to a target browser. Successful exploitation allows arbitrary code execution within the renderer process. Google classifies the Chromium security severity as High, and the CVE is tracked under [CWE-843] (Access of Resource Using Incompatible Type). Exploitation requires user interaction in the form of visiting a malicious page. Google released a fix in the Stable channel update for desktop on June 18, 2024.

Critical Impact
Remote attackers can execute arbitrary code in the V8 renderer process by luring a user to a crafted HTML page, enabling sandbox-bound code execution and a foothold for further exploitation.

Affected Products

Google Chrome (Desktop) versions prior to 126.0.6478.114
Fedora distributions packaging vulnerable Chromium builds
Chromium-based browsers redistributing the affected V8 engine

Discovery Timeline

2024-06-20 - CVE-2024-6100 published to NVD
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-6100

Vulnerability Analysis

The vulnerability resides in V8, the JavaScript and WebAssembly engine that powers Chrome. Type confusion occurs when code allocates or accesses an object assuming one type, while the underlying memory actually holds a different type. In V8, this typically arises from incorrect assumptions made by optimizing compilers such as TurboFan or in inline caches. Once the engine operates on a value with the wrong type, attacker-controlled data can be reinterpreted as object pointers, lengths, or function references. This primitive frequently leads to arbitrary read, arbitrary write, and ultimately arbitrary code execution inside the renderer process. The EPSS probability for this CVE is 0.658% (percentile 71.256), indicating measurable interest among exploit observers.

Root Cause

The defect is an instance of [CWE-843] in V8 object handling. The engine fails to enforce a consistent type contract on a JavaScript object across speculative optimizations or transitions. An attacker who triggers the inconsistent state can manipulate the object as though it were a different shape, breaking V8's memory safety assumptions. Public technical specifics are restricted in the Chromium Issue Tracker entry until a majority of users have updated.

Attack Vector

Exploitation is network-based and requires user interaction. The attacker hosts a crafted HTML page containing JavaScript that triggers the type confusion in V8. When a victim using a vulnerable Chrome build visits the page, the malicious script forces V8 into the confused state and pivots to arbitrary code execution in the renderer. Renderer-level execution can be chained with a sandbox escape to achieve full system compromise. Common delivery channels include phishing links, malvertising, and compromised third-party JavaScript on trusted sites.

No public proof-of-concept exploit is available, and the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog. Technical specifics are intentionally restricted by Google. See the Google Chrome Stable channel update for the official advisory.

Detection Methods for CVE-2024-6100

Indicators of Compromise

Chrome renderer process crashes (chrome.exe --type=renderer) immediately after visiting an external page, especially with access violation or type assertion signatures
Outbound child processes spawned from a Chrome renderer (e.g., cmd.exe, powershell.exe, bash) indicating possible post-exploitation activity
Unexpected network connections originating from the Chrome process to low-reputation domains following web browsing activity

Detection Strategies

Inventory installed Chrome versions across endpoints and flag any build below 126.0.6478.114
Monitor browser process trees for anomalous child processes or memory injection patterns following navigation events
Correlate web proxy logs with EDR telemetry to identify users who visited newly registered or low-reputation domains delivering heavy JavaScript payloads

Monitoring Recommendations

Enable Chrome enterprise reporting to centralize version and crash telemetry for fleet-wide visibility
Forward browser, DNS, and proxy logs to a centralized analytics platform and alert on renderer crash bursts tied to specific URLs
Track Fedora and other Linux package update streams via the Fedora package announcement to confirm Chromium patch deployment

How to Mitigate CVE-2024-6100

Immediate Actions Required

Update Google Chrome to version 126.0.6478.114 or later on all Windows, macOS, and Linux endpoints
Restart Chrome after the update to ensure the new V8 engine binary is loaded into all renderer processes
For Fedora and other Linux distributions, apply the Chromium package update referenced in the Fedora package announcement
Audit Chromium-derived browsers (Edge, Brave, Opera, Vivaldi) and apply their corresponding upstream patches

Patch Information

Google addressed CVE-2024-6100 in the Chrome Stable channel update for desktop, version 126.0.6478.114/115 for Windows and Mac and 126.0.6478.114 for Linux, released on June 18, 2024. Refer to the Google Chrome Stable channel update for full version details.

Workarounds

Enforce Chrome auto-update via enterprise policy so users cannot defer the patch
Disable or restrict JavaScript on untrusted sites using DefaultJavaScriptSetting and URL allow-lists in Chrome enterprise policies
Apply web filtering at the proxy or DNS layer to block access to known-malicious and newly registered domains until patching completes

bash

# Chrome enterprise policy example (Windows registry) to force auto-update
reg add "HKLM\SOFTWARE\Policies\Google\Update" /v UpdateDefault /t REG_DWORD /d 1 /f
reg add "HKLM\SOFTWARE\Policies\Google\Update" /v AutoUpdateCheckPeriodMinutes /t REG_DWORD /d 60 /f

# Fedora / RHEL: update Chromium package
sudo dnf update -y chromium

# Verify installed Chrome version on Linux
google-chrome --version