CVE-2024-7974: Google Chrome V8 API RCE Vulnerability

CVE-2024-7974 Overview

CVE-2024-7974 is a heap corruption vulnerability in the V8 JavaScript engine API used by Google Chrome. The flaw stems from insufficient data validation in the V8 API and affects Chrome versions prior to 128.0.6613.84. A remote attacker can exploit the issue through a crafted Chrome Extension to trigger heap corruption in the browser process. Successful exploitation may lead to arbitrary code execution within the browser context, compromising confidentiality, integrity, and availability of the affected system. Google addressed the issue in the Stable channel update released on August 21, 2024. The Chromium project rated the underlying issue as Medium severity, while the National Vulnerability Database (NVD) assigns a higher score reflecting broader impact.

Critical Impact
Remote attackers can trigger heap corruption in Chrome via a malicious extension, potentially achieving code execution within the browser process.

Affected Products

Google Chrome Desktop (Windows, macOS, Linux) versions prior to 128.0.6613.84
Chromium-based browsers embedding vulnerable V8 builds prior to the 128 milestone
Environments allowing installation of untrusted or side-loaded Chrome Extensions

Discovery Timeline

2024-08-21 - Google releases Chrome 128.0.6613.84 addressing the vulnerability
2024-08-21 - CVE-2024-7974 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-7974

Vulnerability Analysis

The vulnerability resides in the V8 JavaScript engine API surface exposed to Chrome Extensions. V8 is the runtime that executes JavaScript and WebAssembly across Chrome and Chromium-derived browsers. Insufficient validation of data supplied through the V8 API allows a crafted extension to corrupt heap memory managed by V8. Heap corruption in a language runtime is particularly impactful because attacker-controlled data can overlap with internal object metadata, function pointers, or JIT-compiled code regions. The Chromium project categorizes the issue under improper input validation [CWE-20]. Because the attack requires the victim to install a crafted extension, exploitation depends on user interaction. Extensions run with elevated privileges compared to typical web content, giving successful exploitation a strong foothold within the browser sandbox boundary.

Root Cause

The root cause is missing or inadequate validation of parameters passed into V8 API entry points invoked from extension contexts. Without proper bounds and type checks, an extension can supply malformed inputs that cause the runtime to write outside expected heap allocations. This class of defect commonly results in memory corruption primitives usable for further exploitation.

Attack Vector

Exploitation requires a user to install a malicious or compromised Chrome Extension. Once loaded, the extension issues crafted calls into the vulnerable V8 API surface to trigger heap corruption. The attack vector is network-based because extensions can be distributed through the Chrome Web Store, third-party marketplaces, or side-loaded via developer mode. Attackers can also compromise a legitimate extension through supply chain tactics such as developer account takeover or a malicious update push.

See the Chromium Issue Tracker Entry for restricted technical details. Additional context is available in the Google Chrome Stable Update release notes.

Detection Methods for CVE-2024-7974

Indicators of Compromise

Chrome browser processes crashing with heap corruption or access violation signatures shortly after extension load or update events
Newly installed extensions from unknown publishers or side-loaded via developer mode on managed endpoints
Chrome versions reporting as older than 128.0.6613.84 in endpoint inventory data
Unexpected child processes spawned by chrome.exe following extension activity

Detection Strategies

Inventory installed Chrome versions across the fleet and flag any host running a build below 128.0.6613.84
Enumerate installed Chrome Extensions from user profile directories and compare against an allowlist
Monitor Chrome crash telemetry (Windows Error Reporting, crashpad dumps) for repeated V8-related faults
Alert on extension installations occurring outside of managed deployment workflows or enterprise policies

Monitoring Recommendations

Ingest endpoint browser telemetry into a centralized data lake for correlation with process and network events
Track extension IDs, publishers, and permissions across managed devices to detect supply chain compromise
Monitor outbound connections from Chrome renderer and extension processes to unfamiliar domains
Correlate Chrome update status with vulnerability management data to prioritize unpatched hosts

How to Mitigate CVE-2024-7974

Immediate Actions Required

Update Google Chrome to version 128.0.6613.84 or later on all managed endpoints
Force restart of Chrome processes to ensure the patched binary is loaded into memory
Audit installed extensions and remove any that are unnecessary, unverified, or side-loaded
Enforce enterprise policy restricting extension installation to an approved allowlist

Patch Information

Google released Chrome 128.0.6613.84 for the Stable channel on August 21, 2024, which resolves the V8 API validation flaw. Details are documented in the Google Chrome Stable Update release notes. Chromium-based browsers such as Microsoft Edge, Brave, Opera, and Vivaldi should also be updated once vendors integrate the corresponding V8 fix.

Workarounds

Disable installation of third-party extensions via the ExtensionInstallBlocklist and ExtensionInstallAllowlist enterprise policies
Restrict extension sources to the official Chrome Web Store and block developer mode on managed devices
Apply ExtensionSettings policy to enforce runtime host permissions and block unapproved extension IDs
Educate users to avoid installing unfamiliar extensions and to report unexpected browser crashes

bash

# Configuration example: Chrome enterprise policy to restrict extensions (Linux managed policy)
# /etc/opt/chrome/policies/managed/extension_policy.json
{
  "ExtensionInstallBlocklist": ["*"],
  "ExtensionInstallAllowlist": [
    "cjpalhdlnbpafiamejdnhcphjbkeiagm"
  ],
  "DeveloperToolsAvailability": 2,
  "ExtensionInstallSources": [
    "https://chrome.google.com/webstore/*"
  ]
}