CVE-2024-0812 is a high severity (CVSS 8.8) flaw in Accessibility in Google Chrome before 121.0.6167.85. A crafted HTML page could potentially exploit object corruption. Update Chrome to 121.0.6167.85 or later and restart it. Chromium rated this issue High.
What's affected
Google Chrome prior to 121.0.6167.85. The record names Accessibility as the component. The record describes an inappropriate implementation and lists no CWE.
The fix came in the January 2024 Chrome stable channel update that the record links, along with Fedora and Debian package announcements for downstream builds. Chromium based browsers and distribution packages follow their own schedules, so read their notes.
The record carries no CWE entry. NVD scores it 8.8 (High) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
The sources differ on severity. NVD's CVSS 3.1 score is 8.8 (High). The Chrome description carries Chromium's own rating, High. Both are published. The fix is the same update either way.
How to check if you're exposed
Open chrome://version in the browser and read the first line. Anything below 121.0.6167.85 on the desktop stable channel is in the range the record describes. Chromium based browsers that track upstream, and Linux distribution packages of Chromium or Chrome, carry their own version numbers and update timing, so check the vendor's package notes as well.
On managed fleets, pull the browser version from your endpoint management tool instead of asking users. A software inventory that records installed browser versions turns this into a query. Knowing what is installed comes before deciding what is exposed.
What to do now
- Update Chrome to 121.0.6167.85 or later, then restart it so the new build is the one running.
- Update Chromium based browsers, Electron apps and embedded browser components that track upstream, and apply the vendor package updates on Linux.
- Enforce automatic browser updates through device management and report browser versions across the fleet.
- Where you cannot update right away, limit browsing on affected machines to trusted sites until you can.
Why it matters
The record calls this an inappropriate implementation and carries no weakness class, so there is little more to say about the root cause than Chrome's own description: object corruption reachable through a crafted page in the Accessibility component. Treat the update as the control.
Browsers are patched fast. The remaining risk lives in machines that never restart or sit on a pinned version. A fleet wide version report is the cheapest control for that.
The record does not mark this CVE as being in the CISA Known Exploited Vulnerabilities catalog, and nothing in the record says it is exploited in the wild. That can change, so keep it on your watch list.
Quick check
Does restarting matter?
Yes. Chrome downloads the update in the background, but the old version keeps running until the browser relaunches.
Sources
The links below are the references listed in the CVE record. The record and its description were the basis for this post, and the vendor advisory remains the authority for fixed versions.
- chromereleases.googleblog.com
- crbug.com
- lists.fedoraproject.org
- lists.fedoraproject.org
- Safeguard Gold entry for CVE-2024-0812
Last reviewed: 19 October 2026.
