CVE-2024-4671

The use-after-free error consists of accessing a memory area after it has been freed, leading to uncontrolled program behavior. In this case, the vulnerability occurs in the Visuals subsystem responsible for graphics rendering in Chrome. An attacker who has previously compromised the renderer process can provide a specially crafted HTML page that triggers this error and enables code execution outside the isolated browser sandbox environment.

An attacker can escape the browser sandbox and potentially gain the ability to execute code in the operating system context, which may lead to complete takeover of the victim's system, data theft, and violation of system integrity and availability.

Google Chrome must be updated immediately to version 124.0.6367.201 or later. Users of Fedora distributions should apply package updates according to announcements available in Fedora package-announce mailing lists. It is recommended to enable automatic browser updates.

Google Chrome in versions earlier than 124.0.6367.201 and related Fedora Linux packages (Fedoraproject Fedora)

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Google Chromium Visuals contains a use-after-free vulnerability that allows a remote attacker to exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.