{"id":"CVE-2024-4761","kind":"vulnerability","aliases":["CVE-2024-4761"],"related":[],"title":"Out of bounds write in V8 in Google Chrome prior to 124.0.6367.207 allowed a remote attacker to perform an out of…","description":"Google Chromium V8 Engine contains an unspecified out-of-bounds memory write vulnerability via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.\n\nCISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","summary":"An out-of-bounds memory write in the V8 JavaScript engine used by Chromium browsers, triggered by a crafted HTML page. An attacker who gets a user to load that page can corrupt browser memory, which is the usual route to running code in the browser.","severity":"high","cvss":8.8,"epss":null,"exploited":true,"exploited_at":"2024-05-16T00:00:00+00:00","products":[{"name":"Google Chromium V8","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"google chrome","fixed":["124.0.6367.207"],"affected":"< 124.0.6367.207","ecosystem":"vendor"},{"name":"fedoraproject fedora","fixed":[],"affected":"= 38","ecosystem":"vendor"},{"name":"fedoraproject fedora","fixed":[],"affected":"= 39","ecosystem":"vendor"},{"name":"fedoraproject fedora","fixed":[],"affected":"= 40","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["browsers","chrome","chromium","edge","exploited","opera","vendor"],"not_affected_if":["fully-patched-browser"],"how_to_check":"Check the installed Chrome, Edge or Opera version (chrome://version or edge://version) and compare it with the fixed release in the vendor advisory.","fix":"Update Chrome, Edge, Opera or any other Chromium-based browser to a release that includes the vendor's V8 fix for CVE-2024-4761. Exact fixed version: unknown from these sources.","status":"open","published_at":"2024-05-14T16:17:35+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T21:00:43+00:00","updated_at":"2026-10-23T22:29:05+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-10-23T21:00:43Z","model":"claude-haiku-5-5","output":{"fix":"Update Chrome, Edge, Opera or any other Chromium-based browser to a release that includes the vendor's V8 fix for CVE-2024-4761. Exact fixed version: unknown from these sources.","reach":"internet","impact":"high","summary":"An out-of-bounds memory write in the V8 JavaScript engine used by Chromium browsers, triggered by a crafted HTML page. An attacker who gets a user to load that page can corrupt browser memory, which is the usual route to running code in the browser.","category":"vendor","who_cares":["chrome","edge","opera","chromium","browsers"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker code runs inside the browser after a user visits a crafted page","analyst_note":"Confirm the fixed Chromium/Chrome stable version and patch date from the Chrome Releases blog or the Google advisory for CVE-2024-4761; sources given only cite the CISA KEV entry.","how_to_check":"Check the installed Chrome, Edge or Opera version (chrome://version or edge://version) and compare it with the fixed release in the vendor advisory.\nunknown\nunknown","needs_analyst":true,"not_affected_if":["fully-patched-browser"],"user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000519,"input_tokens":2865,"output_tokens":464,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2024':20A,23A '-4761':21A,24A '124.0.6367.207':12A 'action':132C 'affect':112C 'allow':13A 'appli':133C 'attack':16A,66B 'bound':3A,47B,100C 'browser':36B,58B,77B,89B,115C 'chrome':9A,29A,37B,125C 'chromium':26A,38B,57B,91C,118C 'cisa':130C 'code':86B 'contain':94C 'corrupt':76B 'could':111C 'craft':62B,106C 'cve':19A,22A 'discontinu':139C 'edg':39B,127C 'engin':54B,93C 'exploit':40B 'fedora':31A,33A,35A 'fedoraproject':30A,32A,34A 'get':68B 'googl':8A,90C,124C 'google':25A,28A 'html':63B,107C 'includ':119C 'instruct':137C 'javascript':53B 'limit':122C 'load':72B 'memori':48B,78B,101C 'microsoft':126C 'mitig':134C,145C 'multipl':113C 'opera':41B,129C 'out-of-bound':44B,97C 'page':64B,74B,108C 'per':135C 'perform':18A 'prior':10A 'product':143C 'remot':15A 'requir':131C 'rout':83B 'run':85B 'trigger':59B 'unavail':147C 'unspecifi':96C 'use':55B,140C 'user':70B 'usual':82B 'util':117C 'v8':6A,27A,52B,92C 'vendor':42B,136C 'via':104C 'vulner':103C,110C 'web':114C 'write':4A,49B,102C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2024-05-14T16:17:35+00:00","kev":{"dateAdded":"2024-05-16","dueDate":"2024-06-06","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2024-4761","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-4761","severity":null,"published_at":"2024-05-16T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T12:39:22+00:00","note":null},{"source":"nvd","external_id":"CVE-2024-4761","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-4761","severity":null,"published_at":"2024-05-14T16:17:35+00:00","modified_at":"2026-06-17T08:02:50+00:00","first_seen_at":"2026-10-23T22:29:05+00:00","fetched_at":"2026-10-23T22:29:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}