CVE-2024-9859: Google Chrome WebAssembly RCE Vulnerability

CVE-2024-9859 Overview

CVE-2024-9859 is a type confusion vulnerability in the WebAssembly engine of Google Chrome versions prior to 126.0.6478.126. A remote attacker can exploit this flaw by hosting a crafted HTML page and luring a victim to visit it. Successful exploitation enables arbitrary code execution within the Chrome renderer process. The Chromium project rated the underlying issue as High severity. The weakness is classified under CWE-843: Access of Resource Using Incompatible Type.

Critical Impact
Remote attackers can execute arbitrary code in the browser renderer by enticing a user to load a malicious web page that triggers WebAssembly type confusion.

Affected Products

Google Chrome versions prior to 126.0.6478.126
Chromium-based browsers sharing the same V8 and WebAssembly engine
Desktop and mobile builds bundling the affected Chromium release

Discovery Timeline

2024-10-11 - CVE-2024-9859 published to the National Vulnerability Database (NVD)
2025-01-02 - Last updated in the NVD database

Technical Details for CVE-2024-9859

Vulnerability Analysis

The vulnerability resides in Chrome's WebAssembly implementation inside the V8 JavaScript engine. WebAssembly modules are compiled to native code and exchange values with JavaScript using strict type contracts. When the engine misinterprets the type of an object at runtime, it treats memory as a structure it was never allocated as. This category of bug, type confusion, frequently produces an arbitrary read or write primitive inside the renderer.

A remote attacker delivers the exploit through a crafted HTML page that loads a malicious WebAssembly module. User interaction is required, consistent with a drive-by web navigation scenario. Once triggered, the attacker can pivot from renderer code execution to broader actions such as data theft, credential access, or chaining with a sandbox escape. The Chromium issue tracker entry 346197738 is currently access-restricted, as is standard practice for unpatched-by-default users.

Root Cause

The defect is a CWE-843 type confusion in WebAssembly handling. The engine accesses a resource using an incompatible type, breaking memory safety guarantees the JIT relies on. The result is corruption of internal V8 object representations.

Attack Vector

Exploitation occurs over the network through a web page containing crafted WebAssembly bytecode. The attacker hosts the payload or injects it into a compromised site, then directs the victim to the page via phishing, malvertising, or watering-hole tactics. No prior authentication is required, but the user must load the page in a vulnerable Chrome build.

No verified proof-of-concept code is publicly available. The vulnerability mechanism is described in prose; refer to the Chromium Issue Tracker Entry for further technical context once the report is made public.

Detection Methods for CVE-2024-9859

Indicators of Compromise

Chrome renderer process crashes referencing V8 or WebAssembly modules in crash dump metadata
Outbound connections from chrome.exe to newly registered or low-reputation domains immediately after browsing activity
Unexpected child processes spawned by Chrome renderer processes following navigation to untrusted pages
Browser telemetry showing execution of unusually large or obfuscated .wasm payloads from untrusted origins

Detection Strategies

Inventory installed Chrome versions across the fleet and flag any build below 126.0.6478.126
Monitor endpoint telemetry for anomalous post-exploitation behavior originating from Chrome renderer processes, such as token theft or local file reads
Inspect web proxy logs for retrieval of .wasm resources from low-reputation domains paired with user navigation events

Monitoring Recommendations

Centralize Chrome version and update telemetry in your SIEM and alert on out-of-date instances
Correlate browser process behavior with DNS and HTTP egress logs to surface drive-by exploitation patterns
Track Chromium security release notes and pipe new CVE disclosures into vulnerability management workflows

How to Mitigate CVE-2024-9859

Immediate Actions Required

Update Google Chrome to version 126.0.6478.126 or later on all managed endpoints
Update Chromium-based browsers, including Microsoft Edge, Brave, Opera, and Vivaldi, to releases incorporating the fixed Chromium build
Restart Chrome after updating to ensure the patched binary is loaded into memory
Verify automatic update mechanisms are enabled and unblocked on managed devices

Patch Information

Google resolved the issue in Chrome 126.0.6478.126. Administrators should deploy the latest stable channel build through Google Update, enterprise MDM, or package management. Details are tracked in the Chromium Issue Tracker Entry.

Workarounds

Restrict execution of WebAssembly through enterprise policy where feasible, for example using the DefaultJavaScriptJitSetting and site-specific JIT controls
Enforce strict browsing policies that block access to untrusted or uncategorized websites until patching is complete
Apply network-layer URL filtering and DNS controls to limit user exposure to malvertising and watering-hole infrastructure

bash

# Verify Chrome version on Windows endpoints
reg query "HKLM\Software\Google\Chrome\BLBeacon" /v version

# Verify Chrome version on macOS endpoints
defaults read /Applications/Google\ Chrome.app/Contents/Info CFBundleShortVersionString

# Verify Chrome version on Linux endpoints
google-chrome --version