CVE-2024-0804 is a high severity (CVSS 7.5) insufficient policy enforcement in the iOS Security UI of Google Chrome before 121.0.6167.85. A crafted page could leak cross-origin data. Update Chrome to 121.0.6167.85 or later. Chromium itself rated it Medium.
What's affected
Google Chrome prior to 121.0.6167.85. The record names the iOS Security UI as the component and says a remote attacker could leak cross-origin data using a crafted HTML page. The version string is the desktop stable release in the January 2024 update that fixed a group of issues, and Chrome on iOS ships through Apple's update channel, so check the version your device reports.
Fedora package announcements are among the references, so Linux packages of Chromium based browsers also carry fixes.
The record classifies the weakness as CWE-693 (protection mechanism failure). NVD scores it 7.5 (High) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
The sources differ on severity. NVD's CVSS 3.1 score is 7.5 (High). The Chrome description carries Chromium's own rating, Medium. Both are published. Whichever you follow, the fix is the same update.
How to check if you're exposed
Open chrome://version in the browser and read the first line. Anything below 121.0.6167.85 on the desktop stable channel is in the range the record describes. Chromium based browsers that track upstream, and Linux distribution packages of Chromium or Chrome, carry their own version numbers and update timing, so check the vendor's package notes as well.
On managed fleets, pull the browser version from your endpoint management tool instead of asking users. A software inventory that records installed browser versions turns this into a query. Knowing what is installed comes before deciding what is exposed.
What to do now
- Update Chrome to 121.0.6167.85 or later on desktop, and update the iOS app from the App Store.
- Restart the browser after updating, because the old version stays active until relaunch.
- Check Chromium based browsers and embedded browser components that track upstream, and apply their updates as well.
- Use your device management tool to enforce automatic updates and report browser versions.
Why it matters
Policy enforcement failures such as CWE-693 mean a browser protection that should separate sites does not apply in one case. Cross-origin data leaks undermine the same origin policy, the rule that keeps one site from reading another's data.
Browsers patch quickly, and the real risk comes from machines that do not restart or update. A fleet report of browser versions closes that gap.
The record does not mark this CVE as being in the CISA Known Exploited Vulnerabilities catalog, and nothing in the record says it is exploited in the wild. That can change, so keep it on your watch list.
Quick check
Does the Chrome version number apply to iOS?
Not exactly. The record uses the desktop version string. On iOS, check that the app is current in the App Store and read the vendor's notes.
Sources
The links below are the references listed in the CVE record. The record and its description were the basis for this post, and the vendor advisory remains the authority for fixed versions.
- chromereleases.googleblog.com
- crbug.com
- lists.fedoraproject.org
- lists.fedoraproject.org
- Safeguard Gold entry for CVE-2024-0804
Last reviewed: 19 October 2026.
