CVE-2024-5844 is a heap buffer overflow in the Tab Strip of Google Chrome, scored High (CVSS 8.8) in the record and Medium by Chromium. A crafted page could cause an out of bounds read. Update to Chrome 126 or later and relaunch the browser.
What's affected
- Product: Google Chrome, with Fedora 39 and 40 in the record.
- Fixed versions: The Chrome release post says 126.0.6478.54 for Linux and 126.0.6478.56/57 for Windows and Mac, and says the 126.0.6478.56/57 build also went to the extended stable channel. The record says only "prior to 126.0.6478.54". Both are given here because the numbers differ by platform.
- Severity conflict: record High at 8.8, release post Medium.
- Naming note: the record maps it to CWE-787, an out of bounds write, while the description talks about an out of bounds read. The advisory text does not resolve this.
- Exploitation: KEV flag false.
How to check if you're exposed
The quickest check is the About page, chrome://settings/help, which also triggers an update. For scripted checks use one of these:
# Linux
google-chrome --version
# Fedora, if you use the distribution package
rpm -q chromium
# macOS
"/Applications/Google Chrome.app/Contents/MacOS/Google Chrome" --version
# Windows PowerShell
(Get-Item "C:\Program Files\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion
Two sources, two severities. Treat the update as routine but do not defer it.
What to do now
- Apply the Chrome 126 stable update and restart the browser.
- Fedora users on the distribution package should update chromium through the package manager. The record lists Fedora 39 and 40 among affected platforms.
- Audit Chromium-based browsers separately and check each vendor's own security notes for the matching fix.
- After rollout, sample a few machines with the version commands above and confirm the build number.
Why it matters
The record uses CWE-787, out of bounds write, though the plain text of the description says out of bounds read. Mismatches like this happen when a CWE is assigned from the bug title, here "heap buffer overflow", rather than the confirmed effect. The release post held back bug details, so I cannot say which is right.
It shows how to read a record carefully. When the text and the weakness label disagree, report both and avoid claiming more than either source supports. For patching purposes the answer does not change: install the 126 update.
Tracking a batch like this is easier with a single dashboard of browser versions and open CVEs, which is the kind of view a vulnerability management workflow gives you.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is it a read or a write?
The description says out of bounds read. The CWE in the record is 787, out of bounds write. The release post gives no more detail, so both are reported here.
Does the Tab Strip bug need extra user steps?
The record describes a crafted HTML page and does not list gestures, unlike the Tab Groups and Browser UI entries.
Sources
- Chrome Releases: Stable Channel Update for Desktop, 11 June 2024
- Safeguard Gold entry for CVE-2024-5844
Last reviewed: 19 October 2026.
