CVE-2024-3173 is a high severity (CVSS 8.8) insufficient data validation flaw in the Updater in Google Chrome. Per the record, builds before 120.0.6099.62 are affected and a malicious file can lead to OS level privilege escalation. Update Chrome to 120.0.6099.62 or later and verify it on managed machines.
What's affected
Google Chrome prior to 120.0.6099.62, per the NVD record. The Chrome Releases post from December 2023 covers the 120 stable and extended stable updates, lists this CVE as a High item in Updater, and names 120.0.6099.63 for the extended stable channel on Windows and 120.0.6099.62 on Mac. Treat 120.0.6099.62 as the floor and prefer the latest stable build.
The record says a remote attacker could perform OS level privilege escalation via a malicious file. The scoring vector includes user interaction, so a user has to take part for the attack described by NVD to work.
The CVE was published in July 2024, long after the December 2023 fix. If your browsers have updated normally since then, you have the fix.
The weakness class: CWE-345, insufficient verification of data authenticity; CWE-20, improper input validation. The NVD record scores it 8.8 (high) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. CISA Known Exploited Vulnerabilities status in the record: not listed.
How to check if you're exposed
Run chrome://version in the address bar, or google-chrome --version on Linux. Compare the number with the fixed build named above. Managed fleets should check their software inventory or browser management console instead of asking users, because Chrome updates on its own schedule and many machines lag.
Because the flaw sits in the updater rather than the page rendering engine, also look at how Chrome is deployed on your machines. Device images, kiosks and locked down VDI templates are the places where a stale Chrome can sit for years.
What to do now
- Update Chrome to 120.0.6099.62 or later, ideally the current stable release.
- Check golden images and VDI templates for old Chrome installs and rebuild them.
- Confirm the extended stable channel, if you use it, is on 120.0.6099.62 or later.
- Add browser version to your regular asset reporting so stale builds show up.
Why it matters
The record lists two weakness classes: CWE-345, insufficient verification of data authenticity, and CWE-20, improper input validation. In plain terms, the updater accepted data it should have checked more carefully.
Updaters often run with higher privileges than the user, which is what turns a validation mistake into privilege escalation. That makes updater components worth treating as part of your attack surface, not just as plumbing.
Quick check
Does updating the browser fix the updater issue?
Yes. The fix ships in the Chrome build itself, so moving to 120.0.6099.62 or later covers it. Check the Chrome Releases post for the channel you follow if you want the exact build for your platform.
Sources
- Google Chrome Releases blog, December 2023 stable update
- Chromium issue 40075849 (listed in the record; access may be restricted)
- Safeguard Gold entry for CVE-2024-3173
- Free in-browser dependency scan
Last reviewed: 19 October 2026.
