CVE-2024-0223 is a high severity (CVSS 8.8) heap buffer overflow in the ANGLE component of Google Chrome before 120.0.6099.199. A crafted HTML page can corrupt heap memory. Update Chrome to 120.0.6099.199 or later and restart the browser.
What's affected
The record says Google Chrome prior to 120.0.6099.199 is affected. The fix shipped in the Chrome Stable Channel update for desktop announced on 3 January 2024, which the record links. Chromium rates the issue High, and the CVSS 3.1 base score in the record is 8.8, so the two sources agree on the band.
The record's configuration data also lists Fedora 38 and 39, because those distributions package Chromium based browsers. Unlike CVE-2024-0222, this record does not say the renderer must already be compromised.
The Chrome release blog page we fetched showed only the post title, so we could not read the per platform build numbers from it. Check the release post for the exact numbers on Windows, macOS and Linux.
How to check if you're exposed
Open chrome://version in the browser, or run the binary from a terminal:
google-chrome --version
On Windows, Settings then About Chrome shows the version and triggers an update check. Compare the number with 120.0.6099.199. Anything lower is in the affected range according to the record.
Do not stop at the browsers people launch by hand. Chromium based browsers and embedded Chromium runtimes pick up fixes on their own schedule, so check Microsoft Edge, other Chromium browsers, Electron applications and any headless Chrome used for testing, PDF rendering or screenshots. Each vendor ships the Chromium fix in its own release, and the record's reference list includes distribution advisories (Fedora, Gentoo) for packaged Chromium.
For fleets, use your endpoint management tool to report the Chrome version by device and list everything below the fixed build. Browsers that have been open for weeks without a restart are a common gap, because the update only applies after a relaunch.
What to do now
- Report Chrome versions across your devices and list any below 120.0.6099.199.
- Update Chrome and relaunch it, since the fix only applies after a restart.
- Update Edge, other Chromium browsers and Electron apps through their own channels.
- On Linux, update the packaged Chromium through the distribution, and check the Fedora or Gentoo advisories in the record.
- Rebuild container images and test runners that bundle headless Chrome.
Why it matters
The weakness class is CWE-787 (out-of-bounds write). A heap buffer overflow writes past the end of an allocated buffer, which can overwrite neighbouring objects. ANGLE is the layer that translates graphics calls for the browser. The record's description says an attacker could potentially exploit heap corruption via a crafted HTML page, which is the standard language for a memory safety bug in the browser's rendering stack. Heap corruption can lead to code execution in the affected process, and browsers are layered so that such bugs usually need a second flaw to break out of the sandbox.
The vector shows network reachable, no privileges and one user action (visiting a page). That is why 8.8 is the score, and why browser updates matter even for users who only browse the open web. The record's KEV flag is false and neither the record nor the pages we could read say this issue is exploited in the wild.
Browser fixes are among the cheapest security work you can do, since the update is free and automatic for most users. The risk is the long tail: managed devices that defer updates, and embedded Chromium inside applications.
Quick check
What Chrome version fixes CVE-2024-0223?
The record says versions prior to 120.0.6099.199 are affected, so 120.0.6099.199 or later. Check the Chrome release post for per platform numbers.
Is it exploited in the wild?
The record's KEV flag is false, and we found no source claiming exploitation.
Sources
- Chrome Stable Channel Update for Desktop (3 January 2024)
- Gentoo security advisory GLSA 202401-34
- Gold entry for CVE-2024-0223
Last reviewed: 19 October 2026.
