CVE-2024-5838: High Type Confusion in Chrome V8 Memory Access

CVE-2024-5838 is a High (CVSS 8.8) type confusion in V8 in Google Chrome. The record says a remote attacker could perform out of bounds memory access through a crafted HTML page. The fix shipped in Chrome 126, so update to that build or newer and relaunch.

What's affected

• Product: Google Chrome, with Fedora 39 and 40 in the record.
• Fixed versions: The Chrome release post says 126.0.6478.54 for Linux and 126.0.6478.56/57 for Windows and Mac, and says the 126.0.6478.56/57 build also went to the extended stable channel. The record says only "prior to 126.0.6478.54". Both are given here because the numbers differ by platform.
• Severity: High, CVSS 8.8. The Chromium rating is High.
• Siblings: CVE-2024-5830, CVE-2024-5833 and CVE-2024-5837, also V8 type confusions fixed in 126.
• Exploitation: KEV flag false.

How to check if you're exposed

The quickest check is the About page, chrome://settings/help, which also triggers an update. For scripted checks use one of these:

# Linux
google-chrome --version
# Fedora, if you use the distribution package
rpm -q chromium
# macOS
"/Applications/Google Chrome.app/Contents/MacOS/Google Chrome" --version
# Windows PowerShell
(Get-Item "C:\Program Files\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion

This is the last of four V8 type confusions in the release, and the only one whose description drops the word "potentially".

What to do now

1. Apply the Chrome 126 stable update and restart the browser.
2. Fedora users on the distribution package should update chromium through the package manager. The record lists Fedora 39 and 40 among affected platforms.
3. Audit Chromium-based browsers separately and check each vendor's own security notes for the matching fix.
4. After rollout, sample a few machines with the version commands above and confirm the build number.

Why it matters

The record maps this to CWE-843. The wording is slightly firmer than its siblings, since it says the attacker "could perform" the access rather than "potentially perform" it. That is a thin signal, and the record does not explain it. Rely on the CVSS score and patch.

If your team tracks browser risk, one useful habit is to keep a standing rule: any stable channel release that lists High memory safety fixes triggers a fleet update within days. Rules like that beat deciding per CVE. Continuous monitoring of browser versions across endpoints makes the rule easy to enforce.

Try it yourself

Click through it at your own pace, or open it full screen.

Quick check

Sources

• Chrome Releases: Stable Channel Update for Desktop, 11 June 2024
• Safeguard Gold entry for CVE-2024-5838

Last reviewed: 19 October 2026.