CVE-2024-1939 is a high severity (CVSS 8.8) type confusion flaw in the V8 engine of Google Chrome before 122.0.6261.94. A crafted HTML page could corrupt heap memory. Google fixed it in the 27 February 2024 stable update. Update Chrome and restart the browser.
What's affected
Google's stable channel update of 27 February 2024 lists this issue as High and fixed in Chrome 122.0.6261.94 for Mac and Linux, and 122.0.6261.94 or .95 for Windows, rolling out over the following days and weeks. The Extended Stable channel received 122.0.6261.94 for Mac and 122.0.6261.95 for Windows.
NVD says Chrome prior to 122.0.6261.94 is affected and scores it 8.8 (High) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. Chromium's own rating is High, so the sources agree. The record also lists Fedora 38, 39 and 40 because Fedora ships Chromium packages, and its references include Fedora announcements.
Other Chromium based browsers take the V8 fix on their own schedule, so check each vendor's release notes.
How to check if you're exposed
On a desktop, open chrome://version and compare the first line with 122.0.6261.94. Anything older is affected. In a managed fleet, use your endpoint management tool or browser management console to report the installed Chrome version across devices rather than asking people to check.
For Chromium and other browsers built on it, look up the vendor's release notes for the build that contains the 122.0.6261.94 security fixes. Linux packages from distributions may carry the fix under a different version string, so read the distribution advisory.
Also check for apps that embed Chromium, such as desktop apps built with Electron. They bundle their own copy and do not update when your browser does.
What to do now
- Update Chrome to 122.0.6261.94 or later on every managed device.
- Ask users to relaunch the browser, since the update applies only after a restart.
- Update other Chromium based browsers once the vendor ships the fix.
- Inventory desktop apps that embed Chromium and ask their vendors about the fix.
- Enforce an auto-update policy and a maximum browser age through your management tools.
Why it matters
Both V8 issues in this release are classified CWE-843, type confusion. V8 is Chrome's JavaScript engine. Type confusion happens when the engine treats an object as one type while it is really another, which lets the code read or write memory in ways the engine did not plan for. NVD says a crafted HTML page could lead to heap corruption.
The attacker needs a victim to visit the page, which is the UI:R in the vector. Browser flaws of this class are a standard first step in drive by attacks, so rapid auto-update is the main defense. Google's post notes that bug details may stay restricted until most users have updated. The record's KEV flag is false and the release post I read does not say this CVE is exploited in the wild. You can also run a free in-browser dependency scan at gold.safeguard.sh/scan to see which of your projects pull in the affected component. Safeguard reachability analysis can then help you separate code paths that actually call the weak component from those that only list it.
Quick check
Which Chrome version fixes it?
Chrome 122.0.6261.94, or 122.0.6261.94 and .95 on Windows. Anything older is affected.
Does updating the browser cover Electron apps?
No. Electron apps ship their own Chromium and need their own update.
Sources
Last reviewed: 19 October 2026.
