{"id":"CVE-2024-4761","published":"2024-05-14T16:17:35Z","modified":"2026-06-17T08:02:50Z","title":"Google Chromium V8 Out-of-Bounds Memory Write Vulnerability","vendor":"Google","product":"Chromium V8","tier":"core","eol":null,"description":{"text":"Out of bounds write in V8 in Google Chrome prior to 124.0.6367.207 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: High)","provenance":"source","from":"NVD"},"summary":{"text":"Google Chromium's V8 JavaScript engine contains an out-of-bounds write flaw, classified as CWE \"Out-of-bounds Write\", affecting Google Chrome builds prior to 124.0.6367.207. An attacker who can get a victim to load a crafted HTML page can trigger a memory write outside the intended bounds, with the victim needing to interact with the page (user interaction required) and no network access, authentication, or special configuration on the attacker's side beyond serving that page.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:12:54Z"},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.11007,"percentile":0.95891,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2024-05-16","dueDate":"2024-06-06","ransomware":false,"requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://chromereleases.googleblog.com/2024/05/stable-channel-update-for-desktop_13.html; https://nvd.nist.gov/vuln/detail/CVE-2024-4761","provenance":"source"},"vulncheckKev":{"dateAdded":"2024-05-09","exploitedFirstSeen":"2024-05-09","ransomware":false,"evidence":[{"url":"https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit","date":"2024-05-09"},{"url":"https://chromereleases.googleblog.com/2024/05/stable-channel-update-for-desktop_13.html","date":"2024-05-13"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2024-05-16"},{"url":"https://www.uptycs.com/blog/uptycs-quarterly-cyber-threat-bulletin-q2-2024","date":"2024-07-02"},{"url":"https://ti.qianxin.com/uploads/2024/08/19/2274f632f6a1d8acd2f1801c24887edb.pdf","date":"2024-08-19"},{"url":"https://360.net/research/report/#:~:text=PDF-,Download,-Ransomware%20Prevalence%20Report","date":"2025-02-11"},{"url":"https://ti.qianxin.com/uploads/2025/02/21/5c66fbda0feb2714c53f54dcedcd2e43.pdf","date":"2025-02-21"}],"evidenceTotal":7,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"}],"provenance":"machine"},"cwes":[{"id":"CWE-787","name":"Out-of-bounds Write"}],"references":[{"url":"https://chromereleases.googleblog.com/2024/05/stable-channel-update-for-desktop_13.html","tags":["Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/339458194","tags":["Permissions Required"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","tags":["Mailing List"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NTSN22LNYXMWHVTYNOYQVOY7VDZFHENQ/","tags":["Mailing List"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WSUWM73ZCXTN62AT2REYQDD5ZKPFMDZD/","tags":["Mailing List"]},{"url":"https://chromereleases.googleblog.com/2024/05/stable-channel-update-for-desktop_13.html","tags":["Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/339458194","tags":["Permissions Required"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","tags":["Mailing List"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NTSN22LNYXMWHVTYNOYQVOY7VDZFHENQ/","tags":["Mailing List"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WSUWM73ZCXTN62AT2REYQDD5ZKPFMDZD/","tags":["Mailing List"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-4761","tags":["US Government Resource"]}],"techniques":[{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Out-of-Bounds (Read and Write)","mappingType":"exploitation_technique","evidence":[],"comment":"CVE-2024-4761 is an out of bounds write vulnerability that allows a remote attacker to perform an out of bounds memory write via a crafted HTML page. ","confidence":"high"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2024-44358","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-44358","exploited":true,"exploitedSince":"2024-05-16","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":1,"skipped":0,"earliest":"2024-05-14","earliestUrl":"https://github.com/michredteam/CVE-2024-4761","repos":[{"name":"michredteam/CVE-2024-4761","url":"https://github.com/michredteam/CVE-2024-4761","stars":4,"created":"2024-05-14"}]},"first":{"date":"2024-05-14","source":"PoC-in-GitHub","url":"https://github.com/michredteam/CVE-2024-4761"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1059"],"provenance":"source"}],"timeline":[{"date":"2024-05-09","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit","provenance":"source"},{"date":"2024-05-14","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-4761","provenance":"source"},{"date":"2024-05-14","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/michredteam/CVE-2024-4761","provenance":"source"},{"date":"2024-05-16","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2024-05-16","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-44358","provenance":"source"}],"speed":{"daysToPublicExploit":0,"firstExploitFrom":"PoC-in-GitHub","daysToKev":2},"priority":{"score":68.3,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 904 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.18,"detail":"percentile 0.9589"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 PoC-in-GitHub repo"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.16,"detail":"base score 8.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-class-google-chrome-cwe-787"}}