CVE-2024-7975: Google Chrome XSS Vulnerability

CVE-2024-7975 Overview

CVE-2024-7975 is a user interface (UI) spoofing vulnerability in the Permissions component of Google Chrome. The flaw affects versions of Chrome prior to 128.0.6613.84 on desktop platforms. A remote attacker can exploit the issue by serving a crafted HTML page that manipulates permission prompts to mislead users. Google's Chromium team rated the security severity as Medium. Successful exploitation requires user interaction, such as visiting the attacker-controlled page. The vulnerability was patched in the Stable channel update for desktop released by Google on August 21, 2024.

Critical Impact
Attackers can spoof browser permission dialogs through crafted web content, potentially tricking users into granting sensitive permissions such as camera, microphone, geolocation, or notifications to malicious origins.

Affected Products

Google Chrome for Desktop (Windows, macOS, Linux) prior to 128.0.6613.84
Chromium-based browsers that had not integrated the upstream fix
Any embedded Chromium components using the vulnerable Permissions implementation

Discovery Timeline

2024-08-21 - Google releases Chrome 128.0.6613.84 Stable channel update containing the fix
2024-08-21 - CVE-2024-7975 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-7975

Vulnerability Analysis

The vulnerability resides in the Permissions subsystem of the Blink rendering engine and browser UI layer. Chrome exposes permission prompts when a page requests access to sensitive capabilities such as geolocation, camera, microphone, clipboard, or notifications. An inappropriate implementation in this flow allows a crafted HTML page to influence how the prompt is rendered or associated with an origin. The result is UI spoofing, where the user is presented with content that misrepresents the true state of the browser or the origin requesting access. Because exploitation happens purely through web content, no privileged access or authentication is required on the target system.

Root Cause

The root cause is an implementation defect in how the Permissions component composes and displays permission-related UI elements. The advisory does not disclose the specific classes or code paths, and the Chromium issue tracker entry for Issue #347588491 remains access-restricted pending broader patch adoption. NVD categorizes the weakness under NVD-CWE-noinfo because sufficient information was not published to map it to a specific CWE. The behavior aligns with user-interface confusion issues where trust indicators or origin bindings can be manipulated by attacker-controlled content.

Attack Vector

Exploitation requires a victim to load a malicious or compromised page in a vulnerable version of Chrome. The attacker crafts HTML, CSS, or scripted content that triggers or overlaps the permission prompt in a misleading way. A user who believes they are granting a permission to a trusted context may instead grant it to an attacker-controlled origin. Follow-on impact depends on which permission is spoofed, ranging from location tracking to unauthorized media capture. The vulnerability does not, by itself, provide code execution or direct data exfiltration.

No public proof-of-concept, exploit code, or in-the-wild exploitation has been reported. The CVE is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2024-7975

Indicators of Compromise

Browser telemetry showing Chrome versions earlier than 128.0.6613.84 accessing untrusted or newly registered domains
Unexpected grants of sensitive permissions (geolocation, camera, microphone, notifications) tied to low-reputation origins in Preferences or Site Settings
User reports of permission prompts that appear to originate from a different site than the one being viewed

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag any build below 128.0.6613.84
Correlate web proxy logs and DNS telemetry with browsing sessions where permission-related user complaints occur
Review Chrome enterprise reporting for permission grant events to newly observed or uncategorized domains

Monitoring Recommendations

Enable Chrome Enterprise browser reporting and forward events to a centralized analytics or SIEM platform
Monitor endpoint software inventory feeds for Chrome version drift and out-of-date installations
Track user-submitted phishing and suspicious-site reports that reference unexpected browser prompts

How to Mitigate CVE-2024-7975

Immediate Actions Required

Update Google Chrome on all desktop endpoints to 128.0.6613.84 or later
Restart the browser after update to ensure the patched binaries are loaded
Audit currently granted site permissions and revoke access for untrusted or unfamiliar origins
Communicate to users that permission prompts should be scrutinized and denied when in doubt

Patch Information

Google released the fix in the Chrome Stable channel update for desktop on August 21, 2024, covering Windows, macOS, and Linux at version 128.0.6613.84 and 128.0.6613.85. Details are available in the Google Chrome Stable Update advisory. Chromium-based browsers such as Microsoft Edge, Brave, Opera, and Vivaldi should be updated to versions that incorporate the corresponding upstream commit.

Workarounds

Deploy Chrome enterprise policies to disable or restrict sensitive permission prompts where feasible, such as DefaultGeolocationSetting, VideoCaptureAllowed, and AudioCaptureAllowed
Use URL allow-listing and block-listing to prevent navigation to untrusted domains from managed hosts
Enable Safe Browsing Enhanced Protection to increase warnings on suspicious pages

bash

# Example Chrome enterprise policy (JSON) to constrain sensitive permissions
{
  "DefaultGeolocationSetting": 2,
  "DefaultNotificationsSetting": 2,
  "VideoCaptureAllowed": false,
  "AudioCaptureAllowed": false,
  "SafeBrowsingProtectionLevel": 2
}