CVE-2024-9965: Google Chrome RCE Vulnerability

CVE-2024-9965 Overview

CVE-2024-9965 is a high-severity vulnerability in Google Chrome's DevTools component on Windows. The flaw stems from insufficient data validation and affects Chrome versions prior to 130.0.6723.58. A remote attacker who convinces a user to perform specific UI gestures on a crafted HTML page can execute arbitrary code on the target system. Google patched the issue in the Chrome Stable channel update released on October 15, 2024. While Chromium rates the security severity as Low internally, the NVD CVSS 3.1 score is 8.8 due to the network attack vector and high impact on confidentiality, integrity, and availability.

Critical Impact
Successful exploitation allows arbitrary code execution in the browser context on Windows hosts, enabling attacker code to run with the privileges of the Chrome user.

Affected Products

Google Chrome on Windows prior to 130.0.6723.58
Microsoft Windows (host operating system)
Chromium-based browsers sharing the affected DevTools code path

Discovery Timeline

2024-10-15 - Google releases Chrome Stable channel update addressing the issue
2024-10-15 - CVE-2024-9965 published to NVD
2025-03-13 - Last updated in NVD database

Technical Details for CVE-2024-9965

Vulnerability Analysis

The vulnerability resides in Chrome DevTools, the integrated developer tooling shipped with the browser. Google's advisory describes the root issue as insufficient data validation, which permits attacker-controlled input to bypass expected checks within DevTools handling logic. When a user performs specific UI gestures on a crafted HTML page, the validation gap can be leveraged to escape the sandboxed renderer and achieve arbitrary code execution.

The attack vector is network-based and requires user interaction, which aligns with the User Interaction Required flag in the CVSS vector. Despite the user interaction requirement, exploitation does not require authentication. The Chromium issue tracker entry 352651673 references the underlying defect, although Google restricts technical details until a majority of users have updated.

Root Cause

The root cause is improper validation of data processed by DevTools when handling input originating from a web page context. Insufficient validation allows malformed or unexpected structures to be acted upon by privileged browser components. The CWE classification is marked as NVD-CWE-noinfo, indicating Google did not publicly disclose a precise weakness category to limit attacker reverse engineering before broad patch adoption.

Attack Vector

Exploitation requires an attacker to host a malicious HTML page and lure a Chrome user on Windows to visit it. The user must then perform specific UI gestures, such as opening DevTools or interacting with attacker-controlled DevTools UI elements, to trigger the vulnerable code path. Once triggered, attacker-supplied content executes outside the normal renderer sandbox boundary, leading to arbitrary code execution in the browser process context.

No public proof-of-concept exists, the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog, and the EPSS probability score is 0.413%. Refer to the Chromium Issue Tracker Entry for additional technical context once Google releases further details.

Detection Methods for CVE-2024-9965

Indicators of Compromise

Chrome processes spawning unexpected child processes such as cmd.exe, powershell.exe, or rundll32.exe shortly after a DevTools session is opened
Outbound connections from chrome.exe to uncategorized or newly registered domains hosting HTML payloads
Unusual file writes by chrome.exe to user-writable directories like %TEMP% or %APPDATA% correlated with browsing activity
Chrome versions reported by endpoint inventory below 130.0.6723.58 on Windows hosts

Detection Strategies

Inventory installed Chrome versions across the Windows fleet and flag any builds older than 130.0.6723.58
Hunt for process lineage anomalies where chrome.exe is the parent of native Windows interpreters or LOLBins
Correlate DevTools usage telemetry with subsequent suspicious file or network activity from the same browser session
Inspect proxy and DNS logs for users visiting low-reputation HTML pages followed by anomalous endpoint behavior

Monitoring Recommendations

Enable Chrome enterprise reporting to centralize browser version and extension telemetry
Forward Sysmon process creation and network connection events from Windows endpoints to a SIEM for correlation
Alert on any non-browser binary execution chained from chrome.exe within a short time window
Track patch compliance rates weekly until Chrome 130.0.6723.58 or later is universally deployed

How to Mitigate CVE-2024-9965

Immediate Actions Required

Update Google Chrome on all Windows endpoints to version 130.0.6723.58 or later
Restart Chrome after the update so the new binary is loaded into memory
Validate patch deployment through endpoint management tooling and Chrome's chrome://settings/help page
Block or warn on access to untrusted HTML content sources at the web proxy layer

Patch Information

Google addressed CVE-2024-9965 in the Chrome Stable channel update 130.0.6723.58 for Windows, released on October 15, 2024. Details and download channels are listed in the Google Chrome Stable Update advisory. Enterprises using managed Chrome deployments should push the update via Group Policy, Microsoft Intune, or their endpoint management system.

Workarounds

Restrict use of Chrome DevTools through the DeveloperToolsAvailability enterprise policy on managed Windows endpoints
Discourage users from opening DevTools on untrusted web pages until patching is complete
Use browser isolation or remote browsing solutions for high-risk user populations pending patch rollout
Enforce least-privilege Windows user accounts so any code executed via the browser inherits limited rights

bash

# Configuration example: enforce DevTools restriction via Chrome enterprise policy on Windows
# Registry path: HKLM\SOFTWARE\Policies\Google\Chrome
# Value: DeveloperToolsAvailability (DWORD)
#   0 = Allow DevTools (default)
#   1 = Allow DevTools except on force-installed extensions
#   2 = Disallow DevTools

reg add "HKLM\SOFTWARE\Policies\Google\Chrome" /v DeveloperToolsAvailability /t REG_DWORD /d 2 /f