Live › vulnerability › CVE-2024-5274
Go to dashboardA type confusion bug in Chromium's V8 JavaScript engine lets a remote attacker run code by getting a victim to load a crafted HTML page. It is listed as actively exploited in the wild by CISA.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Google Chromium V8 | vendor | – | – |
| google chrome | vendor | < 125.0.6422.112 | 125.0.6422.112 |
| fedoraproject fedora | vendor | = 39 | – |
| fedoraproject fedora | vendor | = 40 | – |
Check the browser version: in Chrome or Edge open the about page (chrome://settings/help or edge://settings/help) and compare against the fixed release, which the sources do not name.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to execute code via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
This page as .md · .json · in your agent: get_signal("CVE-2024-5274")
CISA KEV catalog, Creative Commons 0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.