CVE-2024-5833: High Type Confusion in Chrome V8 Engine

CVE-2024-5833 is a High (CVSS 8.8) type confusion in V8, Chrome's JavaScript engine. The record says a remote attacker could potentially perform out of bounds memory access through a crafted HTML page. Chrome 126 fixes it. Update to that build or newer and relaunch.

What's affected

• Product: Google Chrome, with Fedora 39 and 40 also in the record.
• Fixed versions: The Chrome release post says 126.0.6478.54 for Linux and 126.0.6478.56/57 for Windows and Mac, and says the 126.0.6478.56/57 build also went to the extended stable channel. The record says only "prior to 126.0.6478.54". Both are given here because the numbers differ by platform.
• Severity: High, CVSS 8.8. The Chromium rating is High as well.
• Siblings in the same release: CVE-2024-5830, CVE-2024-5837 and CVE-2024-5838, all V8 type confusions.
• Exploitation: KEV flag false.

How to check if you're exposed

Open chrome://version in the browser, or run one of these from a shell. You want 126.0.6478.54 or later on Linux, and 126.0.6478.56 or later on Windows and Mac.

# Linux
google-chrome --version
# Fedora, if you use the distribution package
rpm -q chromium
# macOS
"/Applications/Google Chrome.app/Contents/MacOS/Google Chrome" --version
# Windows PowerShell
(Get-Item "C:\Program Files\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion

If you track V8 issues, note this is the second of four V8 type confusions in the 126 release.

What to do now

1. Update Chrome to 126.0.6478.54 or later on Linux, or 126.0.6478.56 or later on Windows and Mac, then relaunch it. The fix does not apply until the browser restarts.
2. Check Chromium-based browsers and anything that embeds Chromium separately. Each vendor ships the fix on its own schedule, so look for that vendor's advisory.
3. On managed devices, confirm your update policy has not pinned an older version, and check that users actually relaunched.
4. Record the result in your asset inventory so the next browser release is easier to audit.

Why it matters

The record maps this to CWE-843. Compared with CVE-2024-5830, the description uses the word "potentially" for the out of bounds access, and it names access rather than a write. The record does not explain the difference, and the Chromium bug details were restricted when the release post went out, so avoid reading more into it.

Four V8 type confusions in one release is a good illustration of why engines get frequent updates. Optimizing compilers make assumptions about object types, and a wrong assumption becomes a memory safety problem. The practical response is the same each time: update quickly and keep updates automatic.

Quick check

Sources

• Chrome Releases: Stable Channel Update for Desktop, 11 June 2024
• Safeguard Gold entry for CVE-2024-5833

Last reviewed: 19 October 2026.