Log in Start free

Actively exploited · Published May 9, 2024 · Assigned by Chrome

CVE-2024-4671

Critical 9.6 Exploited

In plain English

A critical-severity use-after-free in Chrome from Google. Attackers are actively exploiting it in the wild (listed by CISA on May 13, 2024). The chance it is exploited in the next 30 days is estimated at 8.3% (higher than 95% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.6Critical
Exploit odds (30 days)8.3%top 5.0% of all CVEs
Exploited in the wildYesCISA KEV since May 13, 2024
Attack toolingNoneno public tooling known

CISA guidance

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Federal agencies must remediate by Jun 3, 2024.

Official description

Use after free in Visuals in Google Chrome prior to 124.0.6367.201 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20qt6-qtwebengine6.6.3-r4ALPINE-CVE-2024-4671
Alpine:v3.21qt6-qtwebengine6.6.3-r4ALPINE-CVE-2024-4671
Alpine:v3.22qt6-qtwebengine6.6.3-r4ALPINE-CVE-2024-4671
Alpine:v3.23qt6-qtwebengine6.6.3-r4ALPINE-CVE-2024-4671
Alpine:v3.24qt6-qtwebengine6.6.3-r4ALPINE-CVE-2024-4671
Debian:12chromium124.0.6367.201-1~deb12u1DEBIAN-CVE-2024-4671
Debian:12chromium124.0.6367.201-1~deb12u1DSA-5687-1
Debian:13chromium124.0.6367.201-1DEBIAN-CVE-2024-4671
Debian:14chromium124.0.6367.201-1DEBIAN-CVE-2024-4671

Affected products (as reported)

VendorProductVersions
Google Chrome 124.0.6367.201 – before 124.0.6367.201

Weakness: CWE-416 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

References