CVE-2024-4761
Published: 14 May 2024
Summary
CVE-2024-4761 is a high-severity Out-of-bounds Write (CWE-787) vulnerability in Fedoraproject Fedora. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 8.9% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2024-4761 is an out-of-bounds write vulnerability in the V8 JavaScript engine within Google Chrome versions prior to 124.0.6367.207. The flaw, assigned CWE-787 and rated high severity with a CVSS 3.1 score of 8.8, permits an attacker to corrupt memory outside allocated bounds when processing a specially crafted HTML page.
A remote attacker can trigger the issue by causing a victim to visit a malicious web page, resulting in an out-of-bounds memory write that may allow arbitrary code execution or other impacts affecting confidentiality, integrity, and availability without requiring authentication or user privileges beyond loading the page.
The primary mitigation is to update Google Chrome to version 124.0.6367.207 or later, as noted in the stable channel release announcement; Fedora package maintainers have also issued corresponding updates for affected Linux distributions.
EPSS for the CVE rose from lower values to a peak of 0.1131 on 2026-03-01 before receding to the current 0.0629, indicating a period of increased exploitation interest after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-44358
Vulnerability details
Out of bounds write in V8 in Google Chrome prior to 124.0.6367.207 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: High)
- CWE(s)
- KEV Date Added
- 16 May 2024
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires timely application of the vendor patch that eliminates the out-of-bounds write in V8.
Implements memory-protection mechanisms (e.g., bounds checking, ASLR, W^X) that block exploitation of the out-of-bounds write.
Restricts or sandboxes mobile code (JavaScript) delivered via crafted HTML pages, limiting the attack surface that triggers the V8 flaw.