CVE-2024-5835 is a High (CVSS 8.8) heap buffer overflow in the Tab Groups feature of Google Chrome. The attacker must convince a user to perform specific UI gestures on a crafted page. Chrome 126 fixes it, so update to that build or newer and relaunch.
What's affected
- Product: Google Chrome, with Fedora 39 and 40 listed in the record.
- Fixed versions: The Chrome release post says 126.0.6478.54 for Linux and 126.0.6478.56/57 for Windows and Mac, and says the 126.0.6478.56/57 build also went to the extended stable channel. The record says only "prior to 126.0.6478.54". Both are given here because the numbers differ by platform.
- Severity: High, CVSS 8.8. The Chromium rating is High.
- Precondition: a user must be persuaded to take specific UI gestures, per the record and the release post.
- Exploitation: KEV flag false.
How to check if you're exposed
The quickest check is the About page, chrome://settings/help, which also triggers an update. For scripted checks use one of these:
# Linux
google-chrome --version
# Fedora, if you use the distribution package
rpm -q chromium
# macOS
"/Applications/Google Chrome.app/Contents/MacOS/Google Chrome" --version
# Windows PowerShell
(Get-Item "C:\Program Files\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion
This bug sits in browser interface code, not the page renderer, which is why the gestures matter.
What to do now
- Apply the Chrome 126 stable update and restart the browser.
- Fedora users on the distribution package should update chromium through the package manager. The record lists Fedora 39 and 40 among affected platforms.
- Audit Chromium-based browsers separately and check each vendor's own security notes for the matching fix.
- After rollout, sample a few machines with the version commands above and confirm the build number.
Why it matters
The record maps this to CWE-787 (out of bounds write) and CWE-122 (heap based buffer overflow). A heap overflow writes more data than a buffer can hold, damaging nearby memory. The record says it could potentially lead to heap corruption.
The interesting detail is the gesture requirement. Most browser memory bugs fire when a page loads. This one needs the user to do something with tabs, so the realistic path is social engineering on top of a crafted page. The CVSS vector still counts user interaction as required, and the score stays at 8.8 because the impact is high.
Quick check
Does the gesture requirement make this safe to ignore?
No. Persuading someone to click or drag is routine for a hostile page. Patch on the normal schedule for High browser bugs.
Which Chrome feature is affected?
Tab Groups, per the release post. Not using tab groups is not a documented mitigation.
Sources
- Chrome Releases: Stable Channel Update for Desktop, 11 June 2024
- Safeguard Gold entry for CVE-2024-5835
Last reviewed: 19 October 2026.
