CVE-2024-8035 Overview
CVE-2024-8035 is a user interface (UI) spoofing vulnerability in the Extensions component of Google Chrome on Windows. The flaw affects Chrome versions prior to 128.0.6613.84 and results from an inappropriate implementation in how the browser renders extension-related UI. A remote attacker can exploit the issue by serving a crafted HTML page, tricking users into interacting with content that misrepresents the true origin or intent of the interface. Chromium classifies the underlying severity as Low, while NVD assigns a medium CVSS rating due to the network attack vector and limited integrity impact.
Critical Impact
Attackers can craft HTML pages that misrepresent Chrome extension UI on Windows, enabling phishing and deception attacks against users who trust the browser chrome.
Affected Products
- Google Chrome on Windows prior to 128.0.6613.84
- Microsoft Windows platforms running vulnerable Chrome builds
- Chromium-based deployments not yet rebased on the 128 stable channel
Discovery Timeline
- 2024-08-21 - Google publishes the Stable Channel Update for Desktop addressing the issue
- 2024-08-21 - CVE-2024-8035 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-8035
Vulnerability Analysis
The vulnerability lives in Chrome's Extensions subsystem on Windows. An inappropriate implementation allows a crafted web page to influence how extension-related UI elements are drawn or presented to the user. The result is a spoofing condition in which attacker-controlled HTML content can be made to appear as legitimate browser or extension UI. NVD associates the entry with [CWE-79] alongside a no-info classification, reflecting the DOM-influenced nature of the spoof. Because exploitation requires the victim to visit a malicious page and interact with it, the attack fits phishing and social-engineering workflows rather than direct code execution.
Root Cause
The root cause is an inappropriate implementation in the Extensions component that fails to enforce clear visual and origin boundaries between untrusted page content and trusted browser UI. Google's advisory does not disclose the specific rendering path, but the outcome enables page-controlled content to overlap or mimic extension UI in ways the user cannot reliably distinguish.
Attack Vector
Exploitation is network-based and requires user interaction. An attacker hosts a crafted HTML page and lures a Chrome user on Windows to visit it, typically through phishing links, malvertising, or a compromised site. When the victim interacts with the page, the spoofed UI can induce the user to grant permissions, disclose credentials, or approve extension-related actions they did not intend. No authentication or elevated privileges are required by the attacker.
No verified proof-of-concept has been published. See the Chromium Issue Tracker Entry for restricted technical details.
Detection Methods for CVE-2024-8035
Indicators of Compromise
- Chrome browser processes on Windows running versions earlier than 128.0.6613.84 after the August 2024 patch window
- User reports of extension prompts, permission dialogs, or overlays that appear on unexpected origins
- Outbound connections from user endpoints to newly registered domains hosting crafted HTML that references extension APIs or overlay elements
Detection Strategies
- Inventory installed Chrome versions across Windows endpoints and flag any build below 128.0.6613.84
- Correlate web proxy logs with browser telemetry to identify sessions where users visited untrusted pages immediately before credential submission or extension permission changes
- Monitor for anomalous extension installation or permission-grant events following user navigation to unclassified domains
Monitoring Recommendations
- Ingest Chrome update and version telemetry into your SIEM to track patch adoption across the fleet
- Alert on user-reported phishing that references browser UI, extension dialogs, or Chrome permission prompts
- Track DNS and HTTP telemetry for domains delivering HTML that mimics browser chrome or extension surfaces
How to Mitigate CVE-2024-8035
Immediate Actions Required
- Update Google Chrome on all Windows endpoints to version 128.0.6613.84 or later
- Force-restart Chrome after deployment so the patched binary is actually loaded into user sessions
- Audit installed extensions and remove any that are unused, unmaintained, or from untrusted publishers
Patch Information
Google addressed the issue in the Chrome Stable Channel release documented in the Google Chrome Update Blog. Upgrading to 128.0.6613.84 or newer on Windows remediates the inappropriate implementation in the Extensions component. Enterprise administrators should validate rollout through Chrome Browser Enterprise policies or their existing patch-management tooling.
Workarounds
- Enforce Chrome auto-update via group policy so users cannot defer the patched build
- Restrict extension installation to an allowlist using the ExtensionInstallAllowlist and ExtensionInstallBlocklist policies
- Deliver user awareness guidance highlighting that legitimate extension prompts originate outside the web page content area
# Example Chrome enterprise policy registry keys on Windows
# Force auto-update and constrain extension sources
reg add "HKLM\Software\Policies\Google\Chrome" /v "UpdateDefault" /t REG_DWORD /d 1 /f
reg add "HKLM\Software\Policies\Google\Chrome\ExtensionInstallBlocklist" /v "1" /t REG_SZ /d "*" /f
reg add "HKLM\Software\Policies\Google\Chrome\ExtensionInstallAllowlist" /v "1" /t REG_SZ /d "<approved-extension-id>" /f
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
