CVE-2024-5837 is a High (CVSS 8.8) type confusion in V8, Chrome's JavaScript engine. A crafted HTML page could potentially allow out of bounds memory access. Chrome 126 fixes it, so update to that build or newer and relaunch the browser.
What's affected
- Product: Google Chrome, plus Fedora 39 and 40 per the record.
- Fixed versions: The Chrome release post says 126.0.6478.54 for Linux and 126.0.6478.56/57 for Windows and Mac, and says the 126.0.6478.56/57 build also went to the extended stable channel. The record says only "prior to 126.0.6478.54". Both are given here because the numbers differ by platform.
- Severity: High, CVSS 8.8, and High in the Chromium rating too.
- The release post credits an anonymous reporter for this one.
- Exploitation: KEV flag false.
How to check if you're exposed
Start with the version string. There is nothing to configure here. The version string settles it.
# Linux
google-chrome --version
# Fedora, if you use the distribution package
rpm -q chromium
# macOS
"/Applications/Google Chrome.app/Contents/MacOS/Google Chrome" --version
# Windows PowerShell
(Get-Item "C:\Program Files\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion
For a fleet, pull the same string from your endpoint management tool and filter for anything older than the 126 build for its platform.
What to do now
- Run the browser update and relaunch. If you manage a fleet, push the 126 build through your usual software distribution channel.
- List the browsers and embedded Chromium runtimes in your estate. Desktop apps that bundle their own Chromium are not fixed by a Chrome update.
- Confirm extended stable users received 126.0.6478.56/57, which the release post says was pushed to that channel.
- Keep automatic updates on. Browser fixes are small and frequent, and delay is the main risk.
Why it matters
CWE-843 again. Three of the four V8 type confusions in this release use the word "potentially" in their description, which reflects how Chromium words bugs where a full exploit path was not demonstrated in public.
It is easy to treat the fourth V8 bug in a release as noise. Do not. Each is a distinct defect that needed its own code fix, and any of them could be the one an attacker works out first. The efficient response is a single update cycle that clears the whole batch.
Quick check
Why are there so many V8 type confusions?
V8 optimizes JavaScript aggressively and relies on type assumptions. When one is wrong the result is memory corruption. The 126 release carried four such fixes.
Is anonymous reporting a concern?
No. It only means the reporter did not ask for credit in the release post.
Sources
- Chrome Releases: Stable Channel Update for Desktop, 11 June 2024
- Safeguard Gold entry for CVE-2024-5837
Last reviewed: 19 October 2026.
