CVE-2024-0806 is a high severity (CVSS 8.8) flaw in Passwords in Google Chrome before 121.0.6167.85. A remote attacker could potentially exploit heap corruption through specific UI interaction. Update Chrome to 121.0.6167.85 or later and restart it. Chromium rated this issue Medium.
What's affected
Google Chrome prior to 121.0.6167.85. The record names Passwords as the component. The weakness is a use after free, and the record says exploitation needs specific user interface interaction.
The fix came in the January 2024 Chrome stable channel update that the record links, along with Fedora and Debian package announcements for downstream builds. Chromium based browsers and distribution packages follow their own schedules, so read their notes.
The record classifies the weakness as CWE-416 (use after free). NVD scores it 8.8 (High) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
The sources differ on severity. NVD's CVSS 3.1 score is 8.8 (High). The Chrome description carries Chromium's own rating, Medium. Both are published. The fix is the same update either way.
How to check if you're exposed
Open chrome://version in the browser and read the first line. Anything below 121.0.6167.85 on the desktop stable channel is in the range the record describes. Chromium based browsers that track upstream, and Linux distribution packages of Chromium or Chrome, carry their own version numbers and update timing, so check the vendor's package notes as well.
On managed fleets, pull the browser version from your endpoint management tool instead of asking users. A software inventory that records installed browser versions turns this into a query. Knowing what is installed comes before deciding what is exposed.
What to do now
- Update Chrome to 121.0.6167.85 or later, then restart it so the new build is the one running.
- Update Chromium based browsers, Electron apps and embedded browser components that track upstream, and apply the vendor package updates on Linux.
- Enforce automatic browser updates through device management and report browser versions across the fleet.
- Where you cannot update right away, limit browsing on affected machines to trusted sites until you can.
Why it matters
A use after free (CWE-416) means the program touches memory after releasing it. Heap corruption of that kind can, in the worst case, let an attacker influence what the program does next. The record says the trigger needs specific user interaction in the Passwords feature, which narrows the practical path.
Browsers are patched fast. The remaining risk lives in machines that never restart or sit on a pinned version. A fleet wide version report is the cheapest control for that.
The record does not mark this CVE as being in the CISA Known Exploited Vulnerabilities catalog, and nothing in the record says it is exploited in the wild. That can change, so keep it on your watch list.
Quick check
Does restarting matter?
Yes. Chrome downloads the update in the background, but the old version keeps running until the browser relaunches.
Sources
The links below are the references listed in the CVE record. The record and its description were the basis for this post, and the vendor advisory remains the authority for fixed versions.
- chromereleases.googleblog.com
- crbug.com
- lists.fedoraproject.org
- lists.fedoraproject.org
- Safeguard Gold entry for CVE-2024-0806
Last reviewed: 19 October 2026.
