CVE-2024-9121: Google Chrome V8 RCE Vulnerability

CVE-2024-9121 Overview

CVE-2024-9121 is an out-of-bounds memory access vulnerability in the V8 JavaScript engine used by Google Chrome. The flaw affects all Chrome versions prior to 129.0.6668.70 and stems from an inappropriate implementation in V8. A remote attacker can exploit the issue by serving a crafted HTML page to a victim. Successful exploitation enables out-of-bounds memory access, which can lead to arbitrary code execution within the renderer process. Google classified the Chromium security severity as High and addressed it in the September 24, 2024 Stable Channel update.

Critical Impact

Remote attackers can trigger out-of-bounds memory access in the V8 engine through a crafted HTML page, exposing browser memory and enabling renderer compromise.

Affected Products

• Google Chrome versions prior to 129.0.6668.70 on Windows, macOS, and Linux
• Chromium-based browsers consuming the vulnerable V8 engine build
• Embedded applications and frameworks bundling pre-129 Chromium releases

Discovery Timeline

• 2024-09-25 - CVE-2024-9121 published to the National Vulnerability Database
• 2025-01-02 - Last updated in NVD database

Technical Details for CVE-2024-9121

Vulnerability Analysis

The vulnerability resides in V8, the JavaScript and WebAssembly engine that powers Chrome. An inappropriate implementation in V8 allows JavaScript executing inside a rendered page to access memory outside the bounds of an allocated object. This class of defect is tracked as [CWE-787] Out-of-Bounds Write. Attackers who control the HTML and JavaScript served to a victim can shape V8 heap state to trigger the condition. The resulting memory corruption can be chained with additional primitives to achieve renderer code execution. Combined with a sandbox escape, the issue could be used as part of a full browser exploit chain.

Root Cause

The defect originates in V8's handling of specific operations where bounds checks are either missing, incorrect, or bypassable through type confusion. When V8 generates optimized code for these operations, the engine references memory outside the intended object boundary. Public details remain limited because Google restricts disclosure of Chromium issue #363538434 until most users have updated.

Attack Vector

Exploitation requires the victim to load attacker-controlled HTML, typically through a malicious website, a compromised advertisement, or a phishing link. No authentication is required, and user interaction is limited to opening the page. Once loaded, embedded JavaScript triggers the vulnerable V8 path and performs out-of-bounds memory access inside the renderer process. The EPSS score of 0.397% places this issue in the 60th percentile for exploit likelihood, but the absence of a public proof of concept reduces immediate risk.

No verified proof-of-concept code is available. See the Chromium Issue #363538434 and the Google Chrome Stable Update advisory for technical references.

Detection Methods for CVE-2024-9121

Indicators of Compromise

• Chrome browser processes (chrome.exe, Google Chrome Helper) spawning unexpected child processes after visiting untrusted sites
• Renderer process crashes with access violation or segmentation fault signatures tied to V8 frames
• Outbound connections from a renderer process to previously unseen domains shortly after page navigation
• Browser instances reporting versions below 129.0.6668.70 in endpoint inventory data

Detection Strategies

• Inventory installed Chrome versions across the fleet and flag any host running a build older than 129.0.6668.70
• Hunt for renderer crash telemetry containing V8 stack frames within minutes of web navigation events
• Correlate browser process anomalies with newly registered or low-reputation domains accessed by users

Monitoring Recommendations

• Forward Chrome update channel status and version data to a centralized logging platform for continuous compliance review
• Monitor endpoint EDR telemetry for unusual memory allocation patterns and child processes originating from browser renderers
• Track web proxy logs for access to attacker-controlled HTML payloads, especially HTML containing heavy JavaScript and WebAssembly content

How to Mitigate CVE-2024-9121

Immediate Actions Required

• Update Google Chrome to version 129.0.6668.70 or later on all Windows, macOS, and Linux endpoints
• Restart Chrome after updating to ensure the patched V8 binary is loaded into all renderer processes
• Audit Chromium-based applications and Electron builds that embed the V8 engine and upgrade to a patched Chromium release

Patch Information

Google released the fix in the Stable Channel update published on September 24, 2024. The patched build is 129.0.6668.70 for Linux and 129.0.6668.70/.71 for Windows and macOS. Details are available in the Google Chrome Stable Update announcement.

Workarounds

• Restrict browsing to trusted sites through enterprise web filtering until patching is complete
• Enforce Chrome's Site Isolation and enhanced Safe Browsing settings via group policy to reduce renderer exposure
• Disable JavaScript on high-risk user profiles where business workflows allow, using the DefaultJavaScriptSetting policy

# Enforce minimum Chrome version through enterprise policy (Windows registry example)
reg add "HKLM\Software\Policies\Google\Chrome" /v TargetVersionPrefix /t REG_SZ /d "129.0.6668.70" /f
reg add "HKLM\Software\Policies\Google\Chrome\URLBlocklist" /v 1 /t REG_SZ /d "*" /f
reg add "HKLM\Software\Policies\Google\Chrome\URLAllowlist" /v 1 /t REG_SZ /d "https://*.corp.example.com" /f