CVE-2024-0808 is a critical severity (CVSS 9.8) flaw in WebUI in Google Chrome before 121.0.6167.85. A malicious file could potentially lead to heap corruption. Update Chrome to 121.0.6167.85 or later and restart it. Chromium rated this issue High.
What's affected
Google Chrome prior to 121.0.6167.85. The record names WebUI as the component. The weakness is an integer underflow, and the record says a malicious file is the trigger.
The fix came in the January 2024 Chrome stable channel update that the record links, along with Fedora and Debian package announcements for downstream builds. Chromium based browsers and distribution packages follow their own schedules, so read their notes.
The record classifies the weakness as CWE-191 (integer underflow). NVD scores it 9.8 (Critical) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
The sources differ on severity. NVD's CVSS 3.1 score is 9.8 (Critical). The Chrome description carries Chromium's own rating, High. Both are published. The fix is the same update either way.
How to check if you're exposed
Open chrome://version in the browser and read the first line. Anything below 121.0.6167.85 on the desktop stable channel is in the range the record describes. Chromium based browsers that track upstream, and Linux distribution packages of Chromium or Chrome, carry their own version numbers and update timing, so check the vendor's package notes as well.
On managed fleets, pull the browser version from your endpoint management tool instead of asking users. A software inventory that records installed browser versions turns this into a query. Knowing what is installed comes before deciding what is exposed.
What to do now
- Update Chrome to 121.0.6167.85 or later, then restart it so the new build is the one running.
- Update Chromium based browsers, Electron apps and embedded browser components that track upstream, and apply the vendor package updates on Linux.
- Enforce automatic browser updates through device management and report browser versions across the fleet.
- Where you cannot update right away, limit browsing on affected machines to trusted sites until you can.
Why it matters
An integer underflow (CWE-191) happens when arithmetic on a number wraps below its minimum, producing a value the code does not expect. When that value feeds a size or index, heap corruption can follow. The record points to a malicious file as the way in.
Browsers are patched fast. The remaining risk lives in machines that never restart or sit on a pinned version. A fleet wide version report is the cheapest control for that.
The record does not mark this CVE as being in the CISA Known Exploited Vulnerabilities catalog, and nothing in the record says it is exploited in the wild. That can change, so keep it on your watch list.
Quick check
Does restarting matter?
Yes. Chrome downloads the update in the background, but the old version keeps running until the browser relaunches.
Sources
The links below are the references listed in the CVE record. The record and its description were the basis for this post, and the vendor advisory remains the authority for fixed versions.
- chromereleases.googleblog.com
- crbug.com
- lists.fedoraproject.org
- lists.fedoraproject.org
- Safeguard Gold entry for CVE-2024-0808
Last reviewed: 19 October 2026.
