CVE-2024-4761: Google Chrome V8 Out-of-Bounds Write via Crafted HTML Page

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityThe vulnerability is in CISA's KEV catalog, indicating active exploitation, and allows remote code execution with only user interaction on a widely deployed browser.

What it is

CVE-2024-4761 is an out-of-bounds write in the V8 JavaScript engine in Google Chrome prior to 124.0.6367.207. A remote attacker can trigger the memory corruption by getting a victim to load a crafted HTML page, which can lead to code execution or a crash in the browser process. The flaw is rated High by Chromium and carries a CVSS 3.1 base score of 8.8.

Impact

An attacker who successfully exploits the out-of-bounds write can corrupt memory in the renderer and potentially achieve arbitrary code execution in the context of the browser. This can lead to full compromise of the user's session, data theft, or further lateral movement from the workstation.

Attack surface

The vulnerability is reached over the network through a crafted HTML page rendered by Chrome, requiring no privileges but requiring user interaction to visit or open the page. The CVSS vector AV:N/AC:L/PR:N/UI:R confirms remote, low-complexity exploitation with user interaction.

Exploitation

CVE-2024-4761 was added to CISA's Known Exploited Vulnerabilities catalog on 2024-05-16 with a remediation due date of 2024-06-06, indicating exploitation in the wild. EPSS gives a 30-day exploitation probability of 0.11007, placing it in the 95.7th percentile.

What to do

• Update Google Chrome to version 124.0.6367.207 or later immediately; this is the primary remediation.
• Apply the corresponding Fedora package updates referenced in the Fedora package-announce mailing lists.
• If immediate patching is not possible, follow CISA KEV required action: apply vendor mitigations or discontinue use of the affected product.
• Enforce automatic browser updates and verify version compliance across managed endpoints.
• Restrict or monitor browsing to untrusted sites where feasible until patching is complete.

Detection

• Monitor for Chrome renderer crashes or abnormal process terminations that may indicate exploitation attempts.
• Hunt for network requests or file downloads delivering HTML pages that trigger V8 memory corruption, using endpoint detection for suspicious browser child processes.
• Check endpoint telemetry for Chrome versions below 124.0.6367.207 to identify unpatched assets.
• Review proxy or DNS logs for known exploit delivery domains if threat intelligence is available.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.