CVE-2024-3174 is a high severity (CVSS 8.8) inappropriate implementation flaw in the V8 JavaScript engine in Google Chrome. Builds before 119.0.6045.105 are affected, and a crafted HTML page could potentially corrupt objects. The fix shipped in late 2023, so update Chrome to 119.0.6045.105 or later.
What's affected
Google Chrome prior to 119.0.6045.105. The Chrome Releases post (its URL places it at the end of October 2023) lists this CVE as a High item in V8. The NVD record applies to Chrome without other bounds.
The record says a remote attacker could potentially exploit object corruption via a crafted HTML page. V8 also underpins other Chromium based products, so check the release notes of any Chromium derivative you run.
The CVE was published in July 2024, long after the fix. Machines updated at any point since late 2023 are covered.
The weakness class: CWE-79, cross site scripting. The NVD record scores it 8.8 (high) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. CISA Known Exploited Vulnerabilities status in the record: not listed.
Source note: the CWE in the NVD record (CWE-79, cross site scripting) does not obviously match the description (object corruption in V8). Check the Chromium issue and the release post if the weakness class matters for your reporting.
How to check if you're exposed
Run chrome://version in the address bar, or google-chrome --version on Linux. Compare the number with the fixed build named above. Managed fleets should check their software inventory or browser management console instead of asking users, because Chrome updates on its own schedule and many machines lag.
What to do now
- Update Chrome to 119.0.6045.105 or later, and prefer the current stable build.
- Restart Chrome. An update that is downloaded but not applied does not protect the session.
- Check Chromium based browsers and embedded runtimes in your inventory for their own fixed versions.
- Report on browser versions across managed devices and chase old ones.
Why it matters
Google described this as an inappropriate implementation in V8, which is the label Chromium uses when behavior does not match what the design intended. The record maps it to CWE-79, cross site scripting.
That mapping looks odd next to a description about object corruption in a JavaScript engine, and we are flagging it rather than smoothing it over. The mapping does not change what you should do. Memory and object handling bugs in V8 are a recurring class, and the dependable control is a short patch cycle for browsers.
Quick check
Why was a 2023 fix published as a 2024 CVE?
The record shows a published date of 16 July 2024, while the Chrome Releases post that lists the fix is from October 2023. The CVE entry was published later than the fix. The fixed build is what matters for exposure.
Sources
- Google Chrome Releases blog, October 31, 2023 stable update
- Chromium issue 40073339 (listed in the record; access may be restricted)
- Safeguard Gold entry for CVE-2024-3174
- Free in-browser dependency scan
Last reviewed: 19 October 2026.
