CVE-2024-5842 is a use after free in the Browser UI of Google Chrome. The record scores it High (CVSS 8.8) and Chromium rated it Medium. An attacker must get a user to perform specific gestures. Update to Chrome 126 or later and relaunch.
What's affected
- Product: Google Chrome, with Fedora 39 and 40 listed in the record.
- Fixed versions: The Chrome release post says 126.0.6478.54 for Linux and 126.0.6478.56/57 for Windows and Mac, and says the 126.0.6478.56/57 build also went to the extended stable channel. The record says only "prior to 126.0.6478.54". Both are given here because the numbers differ by platform.
- Severity conflict: the record says High, CVSS 8.8. Chromium's own rating in the release post is Medium.
- Precondition: the user must engage in specific UI gestures, per the record.
- Exploitation: KEV flag false.
How to check if you're exposed
Start with the version string. This entry has a long history. The release post shows the bug was reported in January 2023 and fixed in June 2024.
# Linux
google-chrome --version
# Fedora, if you use the distribution package
rpm -q chromium
# macOS
"/Applications/Google Chrome.app/Contents/MacOS/Google Chrome" --version
# Windows PowerShell
(Get-Item "C:\Program Files\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion
For a fleet, pull the same string from your endpoint management tool and filter for anything older than the 126 build for its platform.
What to do now
- Run the browser update and relaunch. If you manage a fleet, push the 126 build through your usual software distribution channel.
- List the browsers and embedded Chromium runtimes in your estate. Desktop apps that bundle their own Chromium are not fixed by a Chrome update.
- Confirm extended stable users received 126.0.6478.56/57, which the release post says was pushed to that channel.
- Keep automatic updates on. Browser fixes are small and frequent, and delay is the main risk.
Why it matters
The record maps this to CWE-416. In this case the result is described as an out of bounds memory read, which more often leaks data than gives control. That fits the Medium rating from Chromium, though the CVSS vector still scores confidentiality, integrity and availability all High.
The release post lists the report date as 12 January 2023, which is about seventeen months before the fix release. That is not a criticism. It shows that interface bugs triggered by gestures can be hard to reproduce, and that the date on a CVE says little about when a flaw first existed. If you assess exposure by publication date alone, you will undercount.
Quick check
Why is the severity Medium in one place and High in another?
Chromium uses its own scale. NVD applies CVSS, which scored this 8.8. Use the higher figure for patch priority and note both in your records.
Does it need a malicious website?
The record says a crafted HTML page plus specific UI gestures. A hostile page is the entry point.
Sources
- Chrome Releases: Stable Channel Update for Desktop, 11 June 2024
- Safeguard Gold entry for CVE-2024-5842
Last reviewed: 19 October 2026.
