CVE-2024-6779 Overview
CVE-2024-6779 is an out-of-bounds memory access vulnerability in the V8 JavaScript engine used by Google Chrome versions prior to 126.0.6478.182. A remote attacker can exploit the flaw by serving a crafted HTML page to a victim, potentially leading to a sandbox escape from the renderer process. The issue is tracked under [CWE-787] (Out-of-bounds Write) and [CWE-125] (Out-of-bounds Read), and Chromium engineers rated the security severity as High. Google addressed the vulnerability in the Stable Channel update for desktop in July 2024.
Critical Impact
Successful exploitation enables a remote attacker to break out of the Chrome renderer sandbox through a malicious web page, gaining the ability to execute attacker-controlled logic against the browser process.
Affected Products
- Google Chrome desktop versions prior to 126.0.6478.182
- Chromium-based browsers embedding the vulnerable V8 engine build
- Any application bundling pre-patch V8 from the Chromium 126 branch
Discovery Timeline
- 2024-07-16 - CVE-2024-6779 published to NVD
- 2025-03-20 - Last updated in NVD database
Technical Details for CVE-2024-6779
Vulnerability Analysis
The flaw resides in V8, the JavaScript and WebAssembly engine that compiles and executes script content inside Chrome's renderer process. An out-of-bounds memory access occurs when V8 reads from or writes to memory outside the intended buffer bounds while processing crafted JavaScript. Attackers can leverage the access primitive to corrupt adjacent objects or leak pointers needed to defeat memory protections.
Because V8 runs inside the renderer sandbox, the vulnerability does not directly grant code execution on the host. However, the Chromium issue tracker entry and the CVSS scope change indicate that a working exploit chain can escape the renderer sandbox, transitioning control to a less constrained context. The EPSS data places this CVE in the upper percentile of exploit likelihood, reflecting the historical exploitability of V8 memory corruption bugs.
Root Cause
The root cause is incorrect bounds enforcement in V8 when handling certain JavaScript operations. The engine fails to validate offsets or lengths before accessing typed memory regions, allowing reads or writes past the allocated buffer. This violates the memory safety invariants the engine relies on for object integrity and isolation.
Attack Vector
Exploitation requires only that a user visit a malicious or compromised web page. The attacker delivers crafted HTML containing JavaScript that triggers the out-of-bounds access. No authentication is required, but user interaction (loading the page) is necessary. Drive-by download scenarios, malvertising, and watering-hole attacks are realistic delivery channels.
No verified public exploit code is available. See the Chromium Issue Tracker Entry and the Google Chrome Desktop Update for vendor technical context.
Detection Methods for CVE-2024-6779
Indicators of Compromise
- Chrome installations reporting versions earlier than 126.0.6478.182 in inventory or user-agent telemetry
- Renderer process crashes containing V8 stack frames preceding unexpected child process spawns
- Outbound connections from chrome.exe to unfamiliar domains immediately after rendering untrusted HTML
Detection Strategies
- Monitor endpoint telemetry for anomalous child processes created by chrome.exe or other Chromium-based browser binaries.
- Hunt for renderer sandbox escape behavior such as token manipulation, suspicious file writes to user profile directories, or injection into broker processes.
- Correlate browser crash dumps with subsequent process or network anomalies on the same host.
Monitoring Recommendations
- Inventory Chrome and Chromium-based browser versions across managed endpoints and flag builds below 126.0.6478.182.
- Enable browser crash reporting and forward telemetry to your detection pipeline for analysis.
- Track DNS and HTTP requests to newly registered or low-reputation domains accessed from browser processes.
How to Mitigate CVE-2024-6779
Immediate Actions Required
- Update Google Chrome to version 126.0.6478.182 or later on all desktop platforms.
- Restart Chrome after the update to ensure the patched V8 binary is loaded into running renderer processes.
- Patch downstream Chromium-based browsers and Electron applications once their maintainers ship the V8 fix.
Patch Information
Google released the fix in the Stable Channel update referenced in the Google Chrome Desktop Update advisory. Administrators should validate that enterprise update policies allow Chrome to auto-update or distribute the patched MSI/PKG builds through their software management platform.
Workarounds
- Restrict browsing to trusted sites using enterprise URL allowlists until the patch is deployed.
- Disable JavaScript in Chrome via the DefaultJavaScriptSetting enterprise policy for high-risk users, accepting the functional impact.
- Apply network-layer controls that block known malvertising and exploit-kit infrastructure to reduce drive-by exposure.
# Configuration example: enforce minimum Chrome version via Windows Group Policy registry
reg add "HKLM\Software\Policies\Google\Chrome" /v TargetVersionPrefix /t REG_SZ /d "126.0.6478.182" /f
reg add "HKLM\Software\Policies\Google\Chrome" /v DefaultJavaScriptSetting /t REG_DWORD /d 2 /f
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
