CVE-2024-6999 Overview
CVE-2024-6999 is a user interface (UI) spoofing vulnerability in the Federated Credential Management (FedCM) implementation in Google Chrome. The flaw affects Chrome versions prior to 127.0.6533.72. A remote attacker can exploit the issue by convincing a user to perform specific UI gestures on a crafted HTML page. Successful exploitation lets the attacker misrepresent security-relevant UI elements, which aligns with [CWE-451] (User Interface Misrepresentation of Critical Information). The Chromium project rated the severity as Medium.
Critical Impact
An attacker can spoof FedCM identity prompts to mislead users about the origin or intent of a federated sign-in flow, enabling credential-focused social engineering.
Affected Products
- Google Chrome (Desktop) versions prior to 127.0.6533.72
- Chromium-based browsers incorporating the vulnerable FedCM component
- Deployments where FedCM-based federated sign-in is enabled
Discovery Timeline
- 2024-08-06 - CVE-2024-6999 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-6999
Vulnerability Analysis
FedCM is a browser API that mediates federated sign-in between relying parties and identity providers without relying on third-party cookies. The browser renders a trusted UI element that shows the identity provider, the account being shared, and the site requesting access.
CVE-2024-6999 stems from an inappropriate implementation in this FedCM UI surface. An attacker-controlled page can arrange page content and required user gestures so that the FedCM prompt appears in a misleading context. The user cannot reliably distinguish attacker content from the legitimate credential prompt, which enables UI spoofing categorized under [CWE-451].
The issue does not permit code execution or direct data theft. Impact centers on integrity of the UI shown to the user, with confidentiality and availability unaffected.
Root Cause
The root cause is insufficient isolation and presentation guarantees for the FedCM prompt when the calling page uses specific layout, focus, or gesture sequences. The browser did not consistently prevent web content from overlaying, mimicking, or contextually reframing the FedCM UI in a way that would deceive a reasonable user.
Attack Vector
Exploitation is network-based and requires user interaction. An attacker hosts a crafted HTML page and lures a target to visit it. The page invokes FedCM flows and coordinates them with attacker-controlled visual elements. Because the attack requires the victim to perform specific gestures, exploitation depends on social engineering rather than automated compromise. No authentication and no elevated privileges are required from the attacker.
No verified proof-of-concept code is publicly available. See the Chromium Issue Tracker #340893685 and the Google Chrome Stable Update for vendor context.
Detection Methods for CVE-2024-6999
Indicators of Compromise
- Chrome browser processes reporting versions earlier than 127.0.6533.72 in endpoint inventory data.
- Web browsing telemetry showing navigation to unfamiliar domains immediately followed by federated sign-in events to identity providers such as Google, Okta, or Entra ID.
- User-reported instances of unexpected or duplicated account chooser prompts during sign-in.
Detection Strategies
- Query endpoint inventory for installed Chrome versions and flag any build below 127.0.6533.72 for remediation.
- Correlate identity provider authentication logs with browser telemetry to identify FedCM prompts originating from low-reputation or newly registered domains.
- Baseline expected relying parties that legitimately use FedCM in your environment and alert on deviations.
Monitoring Recommendations
- Monitor identity provider sign-in logs for anomalous relying party origins, particularly for high-value accounts.
- Track browser update compliance through management tooling and produce recurring reports on out-of-date Chrome installs.
- Capture user-submitted phishing reports that reference unusual sign-in dialogs and route them for security review.
How to Mitigate CVE-2024-6999
Immediate Actions Required
- Update Google Chrome to version 127.0.6533.72 or later on all managed endpoints.
- Restart browser processes after the update to ensure the patched binaries are loaded.
- Verify third-party Chromium-based browsers have absorbed the corresponding upstream fix and update them accordingly.
Patch Information
Google addressed CVE-2024-6999 in the Chrome Stable channel release documented in the Google Chrome Stable Update. The fix ships in Chrome 127.0.6533.72 and later. Additional engineering context is tracked in Chromium Issue Tracker #340893685.
Workarounds
- Enforce automatic Chrome updates through enterprise policy so users cannot defer the patched build.
- Deliver targeted user awareness guidance about verifying the origin shown in federated sign-in prompts before selecting an account.
- Restrict browsing to trusted categories through secure web gateway policies for high-risk user groups until patching is confirmed.
# Verify installed Chrome version on Linux endpoints
google-chrome --version
# Windows: query installed version via registry
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv
# macOS: read the CFBundleShortVersionString
defaults read "/Applications/Google Chrome.app/Contents/Info" CFBundleShortVersionString
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
