CVE-2024-3840 is an insufficient policy enforcement flaw in Site Isolation in Google Chrome. NVD scores it 7.5 (High). Chrome versions before 124.0.6367.60 are affected, so update to 124.0.6367.60 or later. Chromium itself labelled the issue Medium.
What's affected
Google Chrome prior to 124.0.6367.60 is affected, per the NVD description and the Chrome stable channel update of 16 April 2024 linked in the record. The fixed version is 124.0.6367.60 for desktop. The record also lists Fedora 38, 39 and 40 because Fedora ships Chromium builds, and its package announcements are linked as references.
The two sources rate the issue differently. The record text ends with the note that the Chromium security severity is Medium, while NVD assigns 7.5, which is High on the CVSS scale. Both are correct in their own scheme: Chromium uses its own severity labels, and NVD scores by the generic CVSS formula. Plan your urgency on the stricter number if you manage a fleet.
The NVD description says a remote attacker could bypass navigation restrictions through a crafted HTML page. It does not mention exploitation in the wild, and the record's KEV flag is false.
The NVD record is dated 2024-04-17 and carries the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, a score of 7.5 (High). Weakness class: CWE-285.
How to check if you're exposed
Open Chrome, go to the three dot menu, then Help, then About Google Chrome. The page shows the version and starts an update check. Anything below 124.0.6367.60 is affected.
On a managed desktop fleet, read the version from your management console or from the command line.
google-chrome --version
On Fedora, check the installed package with your package manager and compare it with the version in the Fedora announcement linked from the record.
rpm -q chromium
If you embed Chromium in an app, such as an Electron shell, the browser version is tied to your app release, so check the bundled Chromium version too.
What to do now
- Update Chrome on every desktop to 124.0.6367.60 or later and relaunch the browser, because the fix only applies after a restart.
- On Fedora, install the updated Chromium package from the announcements referenced in the record.
- Check embedded Chromium in Electron or similar apps and rebuild on a fixed version.
- Confirm fleet versions in your management console a few days after rollout and chase laggards.
Why it matters
The weakness is improper authorization, CWE-285. Site Isolation puts pages from different sites into separate processes so that a compromised page cannot read or steer another site. A policy check that is not enforced everywhere weakens that wall. Here the record says navigation restrictions could be bypassed, with high impact on integrity and none on confidentiality or availability.
Browser flaws like this one are rarely fatal alone, but they matter as part of a chain. They are fixed quietly in the normal release train, which is why the most reliable control is a fast and verified browser update cycle across the fleet.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which Chrome version fixes CVE-2024-3840?
Chrome 124.0.6367.60 or later. The Chrome stable channel update of 16 April 2024 lists the fix.
Why do Chromium and NVD show different severities?
Chromium assigns its own severity label, Medium here. NVD scores the same flaw with CVSS and gets 7.5, which is High. Both numbers come from the sources, so use the higher one when you set patch priority.
Sources
Last reviewed: 19 October 2026.
