CVE-2024-3172 is a high severity (CVSS 8.8) insufficient data validation flaw in DevTools in Google Chrome. Builds before 121.0.6167.85 are affected. The fix shipped in the January 2024 stable update, so update Chrome to 121.0.6167.85 or any later build, including on managed and shared machines.
What's affected
Google Chrome desktop prior to 121.0.6167.85. The Chrome Releases post for the stable channel update dated Tuesday, January 23, 2024 lists 121.0.6167.85 for Mac and Linux and 121.0.6167.85 or .86 for Windows, and names this CVE as a High item in DevTools. The NVD record covers Chrome with no other version bounds.
The record describes an attacker who convinces a user to perform specific UI gestures on a crafted HTML page, which can lead to arbitrary code execution. That user interaction requirement is why the vector shows UI:R. Chromium based browsers that track the same engine may need their own vendor update, so check their release notes too.
A note on dates: the CVE was published in July 2024, but the fix it refers to shipped in January 2024. Anyone who has kept Chrome current since early 2024 already has it.
The weakness class: CWE-20, improper input validation. The NVD record scores it 8.8 (high) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. CISA Known Exploited Vulnerabilities status in the record: not listed.
How to check if you're exposed
Run chrome://version in the address bar, or google-chrome --version on Linux. Compare the number with the fixed build named above. Managed fleets should check their software inventory or browser management console instead of asking users, because Chrome updates on its own schedule and many machines lag.
If you build software that embeds or bundles a Chromium runtime, such as an Electron app, the browser version inside the app is separate from the one the user installed. List those apps in your dependency inventory and check which engine version each ships. The free scan at https://gold.safeguard.sh/scan can help you find bundled components in a project.
What to do now
- Update Chrome to 121.0.6167.85 or later and restart the browser so the update applies.
- Confirm the version on a sample of machines, then use your management tooling to find stragglers on older builds.
- Review Electron and other Chromium embedding apps you ship or run, and rebuild them on a current engine.
- Keep automatic updates on. Do not pin Chrome versions without a patch review owner.
Why it matters
The cause is insufficient validation of data handled by DevTools, the developer tooling built into the browser. The class is CWE-20, improper input validation: the code trusted input it should have checked before acting on it.
DevTools is not a surface most users think about, which is the point. Browser components that sit behind a rarely used feature still run with the browser's privileges. The practical defence is boring and effective: fast, automatic browser updates, plus knowing which of your own applications carry an embedded browser engine that will not update itself.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is CVE-2024-3172 known to be exploited in the wild?
The NVD record does not list it in the CISA Known Exploited Vulnerabilities catalog, and the Chrome Releases post we reviewed does not describe exploitation for this item. That can change, so check the current catalog. The fix is still the same: update to 121.0.6167.85 or later.
Sources
- Google Chrome Releases blog, January 23, 2024 stable update
- Chromium issue 40942152 (listed in the record; access may be restricted)
- Safeguard Gold entry for CVE-2024-3172
- Free in-browser dependency scan
Last reviewed: 19 October 2026.
