CVE-2024-0518 is a high severity (8.8) type confusion in the V8 JavaScript engine in Google Chrome. Chrome releases before 120.0.6099.224 are affected, and the record says a crafted HTML page could trigger heap corruption. Update Chrome to 120.0.6099.224 or later, then restart the browser.
What's affected
- Product: Google Chrome, V8 engine. Affected: versions prior to 120.0.6099.224 (from the NVD description).
- Fixed: 120.0.6099.224 per the record. I could not read the Chrome Releases post body, so check the platform specific version numbers there.
- Chromium rated it High. NVD scores it 8.8 (High), so the two sources agree.
- Exploit path: a remote attacker using a crafted HTML page, so a victim needs to visit or be sent to a page.
- Fedora 38 and 39 appear in the record as affected distribution products, which carry Chromium packages. Check your distribution's advisory.
How to check if you're exposed
- Open chrome://version and read the version string. Anything lower than 120.0.6099.224 is affected.
- On managed fleets, use your endpoint management tool to list the installed Chrome version per device.
- Chromium based browsers and Electron apps ship their own engine, so check them too. The record names Chrome, so confirm each vendor's own advisory.
Keep a record of what you find. An inventory that lists the product, version and owner turns the next advisory into a lookup instead of a search. Safeguard's dependency scan runs in the browser for the software you build.
What to do now
- Update Chrome to 120.0.6099.224 or later and relaunch it.
- Enforce automatic updates and a relaunch deadline through policy on managed devices.
- Check other Chromium based browsers and embedded apps for a patched build.
- On Fedora, install the updated Chromium packages from your distribution's announcements.
- Use gold.safeguard.sh/scan to find Electron or embedded Chromium in your own applications.
Why it matters
The weakness is CWE-843, access of a resource using an incompatible type, known as type confusion. V8 compiles and runs JavaScript at high speed, and a mistake in how it tracks memory or object types can corrupt the heap. Heap corruption in a browser renderer is a common first step toward running attacker chosen code in that process.
The record does not set a known exploited flag, and I did not read an advisory that says it is exploited. The sensible default for a high severity browser engine bug is still to treat the update as urgent. Browsers are the most exposed software on most laptops.
Quick check
Do I need to do anything beyond updating?
Restart the browser. An update that is downloaded but not applied leaves the old code running.
Sources
I fetched the Chrome Releases post but its body did not come through, so the fixed version comes from the NVD description.
- https://chromereleases.googleblog.com/2024/01/stable-channel-update-for-desktop_16.html
- https://crbug.com/1507412
Last reviewed: 19 October 2026.
