CVE-2024-2625 is an object lifecycle issue in the V8 JavaScript engine in Google Chrome before 123.0.6312.58, rated High at 8.8, fixed in 123.0.6312.58. Severity is High at 8.8. Update Chrome to 123.0.6312.58 or later. The sections below cover affected versions, checks and next steps.
What's affected
- Google Chrome before 123.0.6312.58 is affected.
- The Chrome stable update dated 19 March 2024 lists 123.0.6312.58 for Linux and 123.0.6312.58 or .59 for Windows and Mac.
- Fedora 38, 39 and 40 are also listed in the record because they package Chromium, so follow your distribution's notice too.
- Other Chromium based browsers take the fix when they ship the matching Chromium build.
The NVD record gives a CVSS score of 8.8 with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. Published 2024-03-20.
How to check if you're exposed
- Open chrome://version and read the version.
- On Linux,
google-chrome --versionprints it. - On Fedora,
rpm -q chromiumshows the packaged version. - For Edge, Brave and other Chromium browsers, check the vendor's release notes for the Chromium version they include.
What to do now
- Update Chrome to 123.0.6312.58 or later, and restart the browser.
- Update Chromium packages on Linux through your package manager.
- Check embedded browsers in desktop apps that bundle Chromium, because they can lag behind.
- Confirm the update on managed devices.
If this software reaches you as part of something you build, the free in-browser dependency scan at gold.safeguard.sh/scan lists known vulnerabilities in your manifests, and reachability analysis helps you see which ones your code can actually trigger.
Why it matters
The record describes an object lifecycle problem in V8, which can lead to object corruption when a user opens a crafted web page. The vector needs user interaction, which is a page visit, and no privileges. Chromium rates it High, matching the score.
The record carries no CWE for this entry, so I do not label it with a weakness class. Chrome's release post withholds bug details until most users have updated, which is normal practice.
The record's Known Exploited Vulnerabilities flag is false, so CISA has not listed it as exploited.
Chrome 123 fixed a large batch of issues in one release, so one update covers many CVEs.
Chromium based software is wider than the Chrome icon on the desktop. Many desktop applications ship their own copy of Chromium, and these embedded copies update only when the application vendor releases a new build. If an application of that kind opens remote content, ask the vendor which Chromium version it includes. An inventory of installed software with versions makes this question much faster to answer.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Do I need to do anything beyond updating?
Restart the browser after the update. A running Chrome keeps using the old code until it restarts.
Sources
Last reviewed: 19 October 2026.
