CVE-2024-2173 is a high severity flaw in the V8 JavaScript engine in Google Chrome, scored CVSS 8.8. A crafted HTML page can trigger it. Google fixed it in Chrome 122.0.6261.111 on Linux and 122.0.6261.111 or .112 on Windows and Mac, so update and restart the browser.
What's affected
The record says Google Chrome prior to 122.0.6261.111 is affected. Google's Stable Channel Update of 5 March 2024 moved the Stable channel to 122.0.6261.111 or .112 for Windows and Mac and 122.0.6261.111 for Linux, with a roll out over the coming days and weeks. The Extended Stable channel went to 122.0.6261.112 for Windows and Mac. The same update carried three security fixes in total.
Weakness: out of bounds memory access, which is CWE-787. Chromium rates the bug High, and NVD scores it 8.8 with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. That means a network attack of low complexity that needs no privileges but does need the user to visit a page. It was published on 2024-03-06.
The record also lists Fedora 40, since Fedora packages Chromium. Other browsers built on Chromium, and applications that embed it, take the fix on their own schedule, so check each vendor's notes rather than assuming they match Chrome's version.
Google credits an external researcher for the report and says the fix was part of three security fixes in the update. We do not name the researcher here.
How to check if you're exposed
In Chrome, open the address chrome://version in a tab and read the first line. On the command line:
google-chrome --version
chromium --version
On Windows, you can read the version of the installed browser from the About Chrome page under the Help menu. The page also triggers an update check. Any version below 122.0.6261.111 is affected.
In a managed fleet, use your device management tool to report the browser version, and check for machines that have not restarted since the update was downloaded. Chrome downloads fixes in the background but the old version keeps running until the browser restarts.
Do not forget other places that run Chromium. Electron applications, kiosks, embedded browsers and test machines often lag behind. Ask each vendor which Chromium version they ship.
For your own software projects, the free in-browser dependency scan at gold.safeguard.sh/scan can flag packages that bundle a Chromium build.
What to do now
- Update Chrome to 122.0.6261.111 or later (or the newer release on your channel) and restart the browser.
- Use your management tool to confirm every machine reports a fixed version, not just that the update was downloaded.
- For Chromium based browsers and Electron applications, check the vendor notes for the Chromium version they ship, and update them.
- For Linux distributions that package Chromium, apply the distribution update. Fedora 40 is named in the record.
- In the meantime, avoid opening links from untrusted sources on machines that have not updated.
- Keep automatic browser updates on, and make sure users restart the browser when prompted.
Why it matters
Browser engines parse untrusted content all day, so memory safety bugs in them are a steady source of fixes. Out of bounds memory access, which is cwe-787 here. The bug lives in the browser's own code, which means the only reliable answer is the update, not a configuration change.
The CVSS vector needs the user to load a crafted page, so the risk grows with how much of your staff reads links from outside. CVE-2024-2173 is not on the CISA Known Exploited Vulnerabilities list, and none of the sources we read report exploitation in the wild. Browser fixes tend to be rolled out gradually, so confirm that your fleet has the fix rather than assuming it.
Try it yourself
This demo shows how a scan reports that a fixed version already exists, so the work is an update.
Click through it at your own pace, or open it full screen.
Quick check
Is CVE-2024-2173 exploited in the wild?
It is not on the CISA Known Exploited Vulnerabilities list, and the Chrome release note we read does not say it is.
Which version fixes it?
Chrome 122.0.6261.111 on Linux and 122.0.6261.111 or .112 on Windows and Mac, per Google's 5 March 2024 Stable Channel Update.
Sources
- Chrome Releases, Stable Channel Update for Desktop
- Gold entry for CVE-2024-2173
- The Chromium issue tracker entry and the Fedora announcement are referenced by the record but were not retrieved.
Last reviewed: 19 October 2026.
