CVE-2024-5274: Google Chromium V8 Type Confusion Vulnerability

Published May 20, 2024
·
Updated

Chromium: CVE-2024-5274 Type Confusion in V8

Other sources

Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to execute code via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

— CISA

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information. Google is aware that an exploit for CVE-2024-5274 exists in the wild.

— Microsoft

Type Confusion in V8 in Google Chrome prior to 125.0.6422.112 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

— NVD

Credit

Clément Lecigne(Google's Threat Analysis Group), Brendon Tiszka(Chrome Security)

Affected Software

6 affected componentsFixes available
Microsoft Edge (Chromium-based)
Patch available
Google Chrome<125.0.6422.112
125.0.6422.112
Google Chromium V8
Google Chrome<125.0.6422.112
fedoraproject fedora=39
fedoraproject fedora=40

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade Google Chrome (Trace Event) to a version that resolves this vulnerability.

    Fixed in 125.0.6422.112
  2. Upgrade

    Upgrade Google Chrome/Chromium (V8) to a version that resolves this vulnerability.

    Fixed in 125.0.6422.112
  3. Compensating control

    If Chromium-based browsers cannot be mitigated (per vendor instructions), discontinue use of the product.

Event History

May 20, 2024
CVE Published
12:00 AM
Known Exploited
12:00 AM
May 24, 2024
News Published
via BleepingComputer·09:30 AM
News Published
via BleepingComputer·09:31 AM
May 25, 2024
Data Sourced
via Microsoft·03:41 PM
DescriptionSeverityWeakness
May 28, 2024
CVE Published
via MITRE·02:44 PM
Data Sourced
via MITRE·02:44 PM
DescriptionWeakness
Data Sourced
via NVD·03:15 PM
DescriptionSeverityWeaknessAffected Software
Aug 29, 2024
News Published
via BleepingComputer·01:04 PM
May 26, 2025
News Published
via The Register·04:28 AM
News Published
via The Register·04:32 AM

Parent advisories

This vulnerability appears in the following advisories.

Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2024-5274?

CVE-2024-5274 has been identified as a critical vulnerability affecting several Chromium-based browsers.

2

How do I fix CVE-2024-5274?

To fix CVE-2024-5274, ensure you are using the latest version of Google Chrome or Microsoft Edge (Chromium-based) as per the recommended updates.

3

Which products are affected by CVE-2024-5274?

CVE-2024-5274 affects Google Chrome versions up to 125.0.6422.112 and Microsoft Edge based on Chromium.

4

Is CVE-2024-5274 actively exploited?

Yes, Google has confirmed that CVE-2024-5274 is actively being exploited in the wild.

5

What are the recommended actions for CVE-2024-5274?

Users should update their browsers immediately to the latest versions to mitigate the risks associated with CVE-2024-5274.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203