CVE-2024-5274: Google Chrome V8 type confusion allows sandbox code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityCVSS 9.6, CISA KEV listing with known exploitation, and remote code execution in a widely deployed browser make this an urgent patch-first issue.

What it is

Google Chrome before 125.0.6422.112 contains a type confusion flaw in the V8 JavaScript engine. A crafted HTML page can trigger the confusion and lead to arbitrary code execution inside the browser sandbox. The issue is rated critical by CVSS and was added to CISA KEV, so it warrants urgent patching.

Impact

An attacker who gets a victim to load a malicious page can execute arbitrary code within the Chrome sandbox, potentially leading to data theft or further compromise of the host. The CVSS vector shows high confidentiality, integrity and availability impact with scope change.

Attack surface

Reached over the network via a crafted HTML page rendered in Chrome; no authentication is required, but user interaction (opening the page) is needed per the CVSS vector UI:R.

Exploitation

CISA added this to the Known Exploited Vulnerabilities catalog on 2024-05-28 with a due date of 2024-06-18, and a Chromium issue reference is tagged Exploit, indicating active exploitation. EPSS 30-day probability is 0.07472 (94th percentile), consistent with observed exploitation.

What to do

• Update Google Chrome to 125.0.6422.112 or later immediately.
• Apply the corresponding Fedora package updates for Chromium/Chrome.
• If patching cannot be completed, follow CISA guidance to discontinue use of the affected product or apply vendor mitigations.
• Enforce automatic browser updates and verify version compliance across endpoints.
• Restrict browsing of untrusted sites or isolate browser sessions until patched.

Detection

• Monitor for Chrome processes spawning unexpected child processes or making anomalous network connections.
• Hunt for crashes or exploit indicators in Chrome/V8 logs matching the referenced Chromium issue.
• Check endpoint telemetry for known exploitation patterns against CVE-2024-5274 in browser sandbox escapes.
• Track version inventory to identify unpatched Chrome installations below 125.0.6422.112.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.