CVE-2024-7003: Google Chrome FedCM XSS Vulnerability

CVE-2024-7003 Overview

CVE-2024-7003 is a user interface (UI) spoofing vulnerability in the Federated Credential Management (FedCM) implementation of Google Chrome prior to version 127.0.6533.72. A remote attacker who convinces a user to perform specific UI gestures can spoof browser interface elements via a crafted HTML page. Chromium rates this issue's internal security severity as Low. The flaw is tracked under [CWE-358: Improperly Implemented Security Check for Standard]. Google addressed the defect in the stable channel update released on July 23, 2024.

Critical Impact
Attackers can spoof trusted browser UI elements through FedCM, tricking users into disclosing credentials or authorizing identity flows they did not intend to approve.

Affected Products

Google Chrome Desktop versions prior to 127.0.6533.72
Chromium-based browsers embedding the pre-patch FedCM component
Google Chrome Stable channel on Windows, macOS, and Linux prior to the July 23, 2024 update

Discovery Timeline

2024-08-06 - CVE-2024-7003 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-7003

Vulnerability Analysis

The defect resides in Chrome's FedCM component, which brokers federated sign-in flows between relying parties and identity providers. FedCM renders a browser-controlled account chooser and consent dialog that users trust as authoritative UI. An inappropriate implementation in this component allows a crafted HTML page to manipulate FedCM prompts and adjacent browser chrome. When a user performs specific UI gestures induced by the attacker, the resulting rendering misrepresents the origin or intent of the sign-in prompt. This enables convincing phishing overlays that appear to originate from the browser itself.

Root Cause

The root cause is an improperly implemented security check on the FedCM UI surface, categorized as [CWE-358]. FedCM did not sufficiently validate the state or context in which prompts were displayed relative to attacker-controlled page content. The identifier for the underlying Chromium defect is Chromium Issue 338233148.

Attack Vector

Exploitation requires user interaction over the network. An attacker hosts a malicious page and lures a target to visit it. The page uses FedCM APIs and DOM interactions to coax the user into performing gestures such as clicks or focus changes. Those gestures cause the FedCM dialog to render in a way that misleads the user about the identity provider, relying party, or granted permissions. Because the attacker cannot read data directly, the practical impact is limited to integrity of the UI and user deception. Refer to the Chromium Issue Tracker entry for defect-level detail.

Detection Methods for CVE-2024-7003

Indicators of Compromise

Chrome browser processes on endpoints still reporting versions earlier than 127.0.6533.72 in inventory telemetry
Outbound HTTPS connections from browsers to unfamiliar identity provider endpoints immediately followed by credential submission to attacker-controlled domains
User reports of federated sign-in prompts appearing on unexpected sites or referencing unfamiliar identity providers

Detection Strategies

Inventory installed Chrome versions across the estate and flag any build below 127.0.6533.72 as vulnerable
Correlate web proxy or DNS logs with known phishing infrastructure hosting FedCM-based lures
Hunt for HTML pages served to users that invoke the FedCM navigator.credentials.get({identity: ...}) API from untrusted origins

Monitoring Recommendations

Track Chrome auto-update health signals and alert when clients fall more than one stable release behind
Monitor endpoint browsing telemetry for repeated federated sign-in prompt dismissals, which can indicate spoofing attempts
Ingest browser and proxy logs into a central analytics store to correlate FedCM flows with user-reported phishing

How to Mitigate CVE-2024-7003

Immediate Actions Required

Update Google Chrome to version 127.0.6533.72 or later on all managed endpoints
Force a browser relaunch after update deployment to ensure the patched FedCM code path is loaded
Validate that Chromium-based browsers used in the environment have absorbed the upstream fix

Patch Information

Google shipped the fix in the Chrome Stable channel update announced on July 23, 2024. Administrators should deploy version 127.0.6533.72 or later. See the Chrome Releases stable channel update for full release notes and the associated Chromium Issue 338233148.

Workarounds

Educate users to verify the origin displayed in federated sign-in prompts before approving requests
Restrict access to untrusted sites via enterprise web filtering until the browser update is fully rolled out
Where FedCM is not required, disable third-party sign-in flows through enterprise browser policies

bash

# Example: enforce minimum Chrome version via Chrome Enterprise policy (Windows)
# HKLM\Software\Policies\Google\Chrome\TargetVersionPrefix = "127.0.6533.72"
reg add "HKLM\Software\Policies\Google\Chrome" /v TargetVersionPrefix /t REG_SZ /d "127.0.6533.72" /f