CVE-2024-5836 is a High (CVSS 8.8) inappropriate implementation in Chrome DevTools. It requires a user to install a malicious extension, and could then allow code execution through a crafted extension. Chrome 126 fixes it. Update to that build or newer, and review your extensions.
What's affected
- Product: Google Chrome, with Fedora 39 and 40 in the record.
- Fixed versions: The Chrome release post says 126.0.6478.54 for Linux and 126.0.6478.56/57 for Windows and Mac, and says the 126.0.6478.56/57 build also went to the extended stable channel. The record says only "prior to 126.0.6478.54". Both are given here because the numbers differ by platform.
- Severity: High, CVSS 8.8. The Chromium rating is High. Note the vector says no privileges and user interaction required, though the text describes an installed extension.
- Precondition: the user has installed a malicious extension.
- Exploitation: KEV flag false.
How to check if you're exposed
Open chrome://version in the browser, or run one of these from a shell. You want 126.0.6478.54 or later on Linux, and 126.0.6478.56 or later on Windows and Mac.
# Linux
google-chrome --version
# Fedora, if you use the distribution package
rpm -q chromium
# macOS
"/Applications/Google Chrome.app/Contents/MacOS/Google Chrome" --version
# Windows PowerShell
(Get-Item "C:\Program Files\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion
Unlike the web page bugs in this release, the entry point here is an extension, so your extension inventory matters as much as the browser version.
What to do now
- Update Chrome to 126.0.6478.54 or later on Linux, or 126.0.6478.56 or later on Windows and Mac, then relaunch it. The fix does not apply until the browser restarts.
- Check Chromium-based browsers and anything that embeds Chromium separately. Each vendor ships the fix on its own schedule, so look for that vendor's advisory.
- On managed devices, confirm your update policy has not pinned an older version, and check that users actually relaunched.
- Record the result in your asset inventory so the next browser release is easier to audit.
Why it matters
The record maps this to CWE-474, use of a function with inconsistent implementations. Put plainly, one part of DevTools behaved differently from what another part assumed, and a crafted extension could use the gap.
The lesson is not only about this bug. Extensions run with real power inside the browser, and a patched browser does not make an untrusted extension harmless. Pair the update with an allow list of extensions and removal of anything unused. Review who can install extensions on managed machines.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Do I need to worry if nobody installs extensions?
The precondition is a malicious extension, so locked down environments carry less risk. Patch anyway, since it ships with the rest of the 126 fixes.
How should I audit extensions?
Export the installed extension list from your endpoint tooling or chrome://extensions, remove anything not on an approved list, and restrict installs with policy.
Sources
- Chrome Releases: Stable Channel Update for Desktop, 11 June 2024
- Safeguard Gold entry for CVE-2024-5836
Last reviewed: 19 October 2026.
