CVE-2024-1669 is a high severity flaw in Google Chrome, an out of bounds memory access in Blink that a remote attacker can reach through a crafted HTML page. Chrome versions before 122.0.6261.57 are affected. The fix is to update Chrome to 122.0.6261.57 or later and restart the browser.
What's affected
The record says Google Chrome prior to 122.0.6261.57 is affected. The fix shipped in the stable channel update of 20 February 2024, which Google's release notes describe, including an Extended Stable build of 122.0.6261.57 for Windows and Mac. The NVD score is 8.8 (high) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
Blink is Chrome's rendering engine. The Chrome release notes list this as a High severity fix reported by an anonymous researcher on 26 January 2024, with an external bounty. The weakness classes in the record are CWE-787 (out of bounds write) and CWE-125 (out of bounds read).
Chromium based browsers such as Edge, Brave and others take the Chromium fix on their own schedule, so check each one. Linux distributions, including Fedora 38 and 39 listed in the record, ship their own packages.
How to check if you're exposed
Open the About page of the browser and read the version number.
chrome://version
Anything lower than 122.0.6261.57 is affected. On managed fleets, query your endpoint inventory for the Chrome version, and check every Chromium based browser separately. On Linux, check the package manager.
google-chrome --version
What to do now
- Update Chrome to 122.0.6261.57 or later and restart the browser, since the update applies on relaunch.
- Update other Chromium based browsers and embedded browser components as their vendors publish fixes.
- On managed fleets, force the update through policy and report on stragglers.
- Enable automatic updates and check that users are not postponing relaunch for days.
- Update desktop apps built on Chromium that bundle their own engine, as they do not follow the browser update.
Why it matters
Browsers are the most exposed software on most machines, since they run content from anywhere. Memory safety bugs in the rendering engine are the most common source of browser vulnerabilities. Out of bounds access lets code touch memory it should not, and a crafted page may be enough to trigger it.
The record's KEV flag is false for this CVE, and the release notes we read do not report exploitation. Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan can show whether a component tied to this CVE appears in your dependency manifests. The Gold directory keeps the record, severity and references in one place, and reachability analysis helps you separate code paths that can actually be hit from packages that are merely installed. Chromium issue tracker entries may stay restricted until most users have updated.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is it enough to update Chrome only?
No. Other Chromium based browsers and apps with a bundled engine need their own updates. Check each one.
Sources
Last reviewed: 19 October 2026.
