CVE-2024-0519highunder attackCWE-125 CWE-787

CVE-2024-0519: high-severity vulnerability in Google Chrome

Published 16 Jan 2024 · Updated 21 Oct 2025

71Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA and has a public proof of concept.

ssvc Actcvss 8.8epss 3.8%

from disclosure to weapon704 days

Published on NVDJan 16

1st PoC+704d

CISA KEV+1d

exploitation probability

3.8%top 10% of all CVEs

observed exploitation

yesCISA + VulnCheck

1 public exploit(s)

What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗

Not affected

1 product — because the vulnerable code is not present in the product

red_hat_products

Action required by CISAfederal deadline: 2024-02-07

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

In short

A memory safety flaw in Chrome's V8 engine allows attackers to access memory outside safe boundaries through a malicious webpage, potentially corrupting the browser's memory and executing harmful code.

Technical detail

Out-of-bounds read/write in V8 JavaScript engine (CWE-125, CWE-787) exploitable via crafted HTML delivered to remote users; heap corruption may enable arbitrary code execution with victim's browser privileges. Requires user interaction (visiting malicious page).

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Out of bounds memory access in V8 in Google Chrome prior to 120.0.6099.224 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

Google · Chrome

public PoCs found — 1

vulncheckvulncheck.com/xdb/a157e9bcde1cunverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.