CVE-2024-1675 is a high severity flaw in Google Chrome, an insufficient policy enforcement in Download that a remote attacker can reach through a crafted HTML page. Chrome versions before 122.0.6261.57 are affected. The fix is to update Chrome to 122.0.6261.57 or later and restart the browser.
What's affected
The record says Google Chrome prior to 122.0.6261.57 is affected. The fix shipped in the stable channel update of 20 February 2024, which Google's release notes describe, including an Extended Stable build of 122.0.6261.57 for Windows and Mac. The NVD score is 8.8 (high) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
The Download component applies rules about where and how files may be saved. The record says insufficient policy enforcement lets a remote attacker bypass filesystem restrictions through a crafted HTML page. The release notes credit Bartlomiej Wacko and list it as Medium. The weakness in the record is CWE-284 (improper access control).
Severity differs between sources. The NVD record scores it 8.8 (high) and Chromium rates it Medium.
Chromium based browsers such as Edge, Brave and others take the Chromium fix on their own schedule, so check each one. Linux distributions, including Fedora 38 and 39 listed in the record, ship their own packages.
How to check if you're exposed
Open the About page of the browser and read the version number.
chrome://version
Anything lower than 122.0.6261.57 is affected. On managed fleets, query your endpoint inventory for the Chrome version, and check every Chromium based browser separately. On Linux, check the package manager.
google-chrome --version
What to do now
- Update Chrome to 122.0.6261.57 or later and restart the browser, since the update applies on relaunch.
- Update other Chromium based browsers and embedded browser components as their vendors publish fixes.
- On managed fleets, force the update through policy and report on stragglers.
- Enable automatic updates and check that users are not postponing relaunch for days.
- Update desktop apps built on Chromium that bundle their own engine, as they do not follow the browser update.
Why it matters
Browsers are the most exposed software on most machines, since they run content from anywhere. Policy enforcement bugs are failures to apply a rule that was meant to hold. They are less dramatic than memory corruption, but they weaken the sandbox around the download path.
The record's KEV flag is false for this CVE, and the release notes we read do not report exploitation. Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan can show whether a component tied to this CVE appears in your dependency manifests. The Gold directory keeps the record, severity and references in one place, and reachability analysis helps you separate code paths that can actually be hit from packages that are merely installed. Chromium issue tracker entries may stay restricted until most users have updated.
Quick check
Is it enough to update Chrome only?
No. Other Chromium based browsers and apps with a bundled engine need their own updates. Check each one.
Sources
Last reviewed: 19 October 2026.
