Use-after-free in Google Chromium - CVE-2024-4671

Vulnerability identifier: #VU89324

CSH Severity: Critical

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-4671

CWE-ID: CWE-416

Exploitation vector: Remote access

Exploit availability: The vulnerability is being exploited in the wild

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the Visuals component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Note, the vulnerability is being actively exploited in the wild.

Google Chromium
Microsoft Edge
Google Chrome
Gentoo Linux
Debian Linux
Fedora
Chrome OS
Dell Hybrid Client
www-client/opera
chromium
chromium (Debian package)
www-client/microsoft-edge
www-client/chromium
www-client/google-chrome

Install update from vendor's website.

Google Chromium - update to 124.0.6367.201
Microsoft Edge - update to 124.0.2478.97
Google Chrome - update to 124.0.6367.201
www-client/opera - update to 114.0.5282.21
Chrome OS - update to 120.0.6099.310
chromium - addressed in versions 124.0.6367.201-1.el8, 124.0.6367.201-1.el9, 124.0.6367.201-1.fc38, 124.0.6367.201-1.fc39, 124.0.6367.201-1.fc40, 125.0.6422.60-1.el8, 125.0.6422.60-1.el9, 125.0.6422.60-1.fc38, 125.0.6422.60-1.fc39, 125.0.6422.60-1.fc40, 125.0.6422.76-1.el7, 125.0.6422.76-1.el8, 125.0.6422.76-1.el9
chromium (Debian package) - update to 124.0.6367.201-1~deb12u1
www-client/microsoft-edge - update to 128.0.2739.42
www-client/chromium - update to 128.0.6613.84
www-client/google-chrome - update to 128.0.6613.84

• https://chromereleases.googleblog.com/2024/05/stable-channel-update-for-desktop_9.html
• https://crbug.com/339266700

• Remote code execution in Google Chrome
• Fedora 40 update for chromium
• Fedora 39 update for chromium
• Fedora EPEL 8 update for chromium
• Fedora 38 update for chromium
• Fedora EPEL 9 update for chromium
• Multiple vulnerabilities in Microsoft Edge
• Multiple vulnerabilities in Google ChromeOS
• Fedora 39 update for chromium
• Fedora 40 update for chromium
• Fedora 38 update for chromium
• Fedora EPEL 9 update for chromium
• Fedora EPEL 8 update for chromium
• Fedora EPEL 9 update for chromium
• Fedora EPEL 7 update for chromium
• Fedora EPEL 8 update for chromium
• Debian update for chromium
• Multiple vulnerabilities in Dell Hybrid Client
• Gentoo update for Chromium, Google Chrome, Microsoft Edge. Opera