CVE-2024-5841 is a use after free in V8, the JavaScript engine in Google Chrome. The record scores it High (CVSS 8.8), while Chromium's own rating is Medium. Both agree on the action: update to Chrome 126 or later and relaunch.
What's affected
- Product: Google Chrome, with Fedora 39 and 40 listed in the record.
- Fixed versions: The Chrome release post says 126.0.6478.54 for Linux and 126.0.6478.56/57 for Windows and Mac, and says the 126.0.6478.56/57 build also went to the extended stable channel. The record says only "prior to 126.0.6478.54". Both are given here because the numbers differ by platform.
- Severity conflict: the record says High, CVSS 8.8. The Chrome release post lists it as Medium under the Chromium security severity scale. Neither is wrong, because they measure different things.
- Exploitation: KEV flag false.
How to check if you're exposed
Open chrome://version in the browser, or run one of these from a shell. You want 126.0.6478.54 or later on Linux, and 126.0.6478.56 or later on Windows and Mac.
# Linux
google-chrome --version
# Fedora, if you use the distribution package
rpm -q chromium
# macOS
"/Applications/Google Chrome.app/Contents/MacOS/Google Chrome" --version
# Windows PowerShell
(Get-Item "C:\Program Files\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion
When two sources rate a bug differently, patch to the higher score and move on.
What to do now
- Update Chrome to 126.0.6478.54 or later on Linux, or 126.0.6478.56 or later on Windows and Mac, then relaunch it. The fix does not apply until the browser restarts.
- Check Chromium-based browsers and anything that embeds Chromium separately. Each vendor ships the fix on its own schedule, so look for that vendor's advisory.
- On managed devices, confirm your update policy has not pinned an older version, and check that users actually relaunched.
- Record the result in your asset inventory so the next browser release is easier to audit.
Why it matters
The record maps this to CWE-416, use after free. A use after free in V8 is a memory safety bug in the JavaScript engine, and the record says a crafted page could potentially lead to heap corruption.
The severity gap is worth a sentence. CVSS scores the worst plausible outcome of a bug class in the abstract, which gives 8.8 for any browser bug that can lead to code execution with one click. Chromium weighs how hard the bug is to reach and what mitigations such as the sandbox change. For your patch schedule, use the higher number, because the cost of updating a browser is small.
The release post also shows the bug was reported in February 2024, well before the fix shipped in June, a reminder that some fixes wait for a release train.
Quick check
Which severity should I use in my tracker?
The record gives CVSS 8.8 High and Chromium gives Medium. Many teams record both and prioritize on the higher one for browsers, since patching is cheap.
Does the Medium rating mean no sandbox escape?
The release post does not say. A Medium rating is Chromium's own judgement, not a promise about how an attack would play out.
Sources
- Chrome Releases: Stable Channel Update for Desktop, 11 June 2024
- Safeguard Gold entry for CVE-2024-5841
Last reviewed: 19 October 2026.
