CVE-2024-5830 is a High (CVSS 8.8) type confusion bug in V8, the JavaScript engine in Google Chrome. A crafted HTML page could cause an out of bounds memory write. It was fixed in the Chrome 126 stable release of 11 June 2024, so update and relaunch the browser.
What's affected
- Product: Google Chrome. The record also lists Fedora 39 and 40 as platforms.
- Fixed versions: The Chrome release post says 126.0.6478.54 for Linux and 126.0.6478.56/57 for Windows and Mac, and says the 126.0.6478.56/57 build also went to the extended stable channel. The record says only "prior to 126.0.6478.54". Both are given here because the numbers differ by platform.
- Severity: High, CVSS 8.8, vector network, low complexity, no privileges, user interaction required. The Chromium project rated it High as well, so the two sources agree.
- Exploitation: the record's KEV flag is false and the release post does not say it was exploited.
How to check if you're exposed
Open chrome://version in the browser, or run one of these from a shell. You want 126.0.6478.54 or later on Linux, and 126.0.6478.56 or later on Windows and Mac.
# Linux
google-chrome --version
# Fedora, if you use the distribution package
rpm -q chromium
# macOS
"/Applications/Google Chrome.app/Contents/MacOS/Google Chrome" --version
# Windows PowerShell
(Get-Item "C:\Program Files\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion
V8 bugs are checked at the engine level, so there is no per-site setting that reduces the risk. The only reliable check is the build number.
What to do now
- Update Chrome to 126.0.6478.54 or later on Linux, or 126.0.6478.56 or later on Windows and Mac, then relaunch it. The fix does not apply until the browser restarts.
- Check Chromium-based browsers and anything that embeds Chromium separately. Each vendor ships the fix on its own schedule, so look for that vendor's advisory.
- On managed devices, confirm your update policy has not pinned an older version, and check that users actually relaunched.
- Record the result in your asset inventory so the next browser release is easier to audit.
Why it matters
The record maps this to CWE-843 (access of a resource using an incompatible type) and CWE-787 (out of bounds write). In a type confusion, the engine treats an object as one type when it is really another, so it reads or writes memory using the wrong layout. In a JavaScript engine that can turn page script into writes outside the intended buffer.
The release post lists this as the first of several V8 type confusion fixes in 126, and the highest reward in the batch. That tells you the Chromium team judged it among the more serious findings of the cycle. It does not tell you it was used in attacks, and nothing I read says so.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is there a setting that blocks this without updating?
Nothing in the record or the release post describes a workaround. Update the browser. Turning off JavaScript would stop the page script that reaches V8 but would break most sites.
Does a Chrome update fix Electron apps?
No. Apps that bundle their own Chromium or V8 need an update from their own vendor. Ask each vendor which Chromium build they ship.
Sources
- Chrome Releases: Stable Channel Update for Desktop, 11 June 2024
- Safeguard Gold entry for CVE-2024-5830
Last reviewed: 19 October 2026.
