CVE-2024-9369: Google Chrome RCE Vulnerability

CVE-2024-9369 Overview

CVE-2024-9369 is an insufficient data validation vulnerability in the Mojo inter-process communication (IPC) layer of Google Chrome. Versions prior to 129.0.6668.89 are affected. A remote attacker who has already compromised the renderer process can trigger an out-of-bounds memory write through a crafted HTML page. Successful exploitation can break out of the renderer sandbox and corrupt memory in a more privileged Chrome process. Google rates the upstream Chromium severity as High, while the NVD entry reflects a CVSS 3.1 score of 9.6 with a changed scope. The flaw is tracked under [CWE-1284] (Improper Validation of Specified Quantity in Input).

Critical Impact

Out-of-bounds memory write reachable from a compromised renderer enables sandbox escape and memory corruption in a higher-privilege Chrome process.

Affected Products

• Google Chrome (Desktop) versions prior to 129.0.6668.89
• Chromium-based browsers shipping the vulnerable Mojo IPC code
• Embedded Chromium components using Mojo before the 129 release

Discovery Timeline

• 2024-11-27 - CVE-2024-9369 published to the National Vulnerability Database
• 2025-11-20 - Last updated in the NVD database

Technical Details for CVE-2024-9369

Vulnerability Analysis

Mojo is the IPC system Chrome uses to pass messages between sandboxed renderers and more privileged processes such as the browser and GPU process. The vulnerability stems from insufficient validation of data fields received over a Mojo interface. An attacker controlling a compromised renderer can send a crafted message whose declared size or count does not match the actual payload. The receiving process trusts the attacker-supplied value and writes past the bounds of an allocated buffer.

This class of bug is particularly damaging because Mojo endpoints live in processes outside the renderer sandbox. A successful write primitive in the browser process effectively bypasses the site-isolation and sandboxing boundaries that Chrome relies on. Combined with a prior renderer compromise, typically obtained through a separate V8 or Blink bug delivered by a malicious HTML page, the chain enables full sandbox escape.

Root Cause

The root cause is improper validation of a length or count field in deserialized Mojo input, consistent with [CWE-1284]. The code path uses an attacker-controlled quantity to index into or copy data into a fixed-size buffer without verifying the value against the destination capacity. The result is an out-of-bounds write at an attacker-influenced offset.

Attack Vector

Exploitation requires two stages. First, the attacker lures a user to a crafted HTML page that triggers a renderer-side vulnerability to gain code execution inside the sandboxed renderer. Second, the compromised renderer sends a malformed Mojo message that exercises the unvalidated field, producing the out-of-bounds write in a more privileged process. No additional credentials are required, but user interaction (visiting the page) is necessary.

No verified public proof-of-concept code is available. See the Chromium Issue Tracker Entry and the Google Chrome Stable Update for vendor details.

Detection Methods for CVE-2024-9369

Indicators of Compromise

• Chrome renderer or browser process crashes with access violation signatures referencing Mojo bindings or IPC message dispatch.
• Unexpected child processes spawned by chrome.exe shortly after visiting an untrusted page.
• Outbound connections from Chrome to attacker-controlled infrastructure following a crash-and-restart sequence.

Detection Strategies

• Inventory Chrome installations and flag any host running a version below 129.0.6668.89 as exposed.
• Monitor Windows Error Reporting and crash dump telemetry for repeated faults in chrome.dll modules tied to Mojo.
• Hunt for browser process injection or unusual handle duplication originating from the Chrome browser process, indicative of post-escape activity.

Monitoring Recommendations

• Forward endpoint process, file, and network telemetry to a central data lake for correlation across browser exploitation indicators.
• Alert on Chrome child processes launching shells, script interpreters, or LOLBins such as rundll32.exe and mshta.exe.
• Track browser version drift using software inventory tooling and trigger remediation workflows when builds fall behind the stable channel.

How to Mitigate CVE-2024-9369

Immediate Actions Required

• Update Google Chrome to version 129.0.6668.89 or later on all desktop platforms.
• Restart browsers after the update to ensure the patched binaries are active.
• Apply equivalent updates to Chromium-based browsers and embedded WebView components that consume the same Mojo code.

Patch Information

Google addressed CVE-2024-9369 in the Chrome stable channel release 129.0.6668.89. Distribution details are documented in the Google Chrome Stable Update advisory, with technical context in the Chromium Issue Tracker Entry. Enterprises using managed Chrome should push the update through their existing software distribution channels and verify rollout via the chrome://version page.

Workarounds

• No vendor-supplied workaround exists; patching is the only supported remediation.
• Enforce site isolation and restrict browsing to trusted domains using enterprise policy until patching completes.
• Reduce exposure by disabling unnecessary Chrome extensions and blocking high-risk web categories at the proxy.

# Verify Chrome version on Windows endpoints
reg query "HKLM\SOFTWARE\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv

# Force update check via the Chrome management policy on Linux
/opt/google/chrome/chrome --product-version