Security readout for executives and security teams
Plain-English summary
CVE-2024-4671 is a Chrome memory safety flaw that can help an attacker escape the browser sandbox after compromising the renderer. A user must interact with a crafted HTML page. CISA lists it as known exploited, so unmanaged or slow-updating browsers create real business risk.
Executive priority
Treat this as urgent browser remediation. It is internet-reachable through normal browsing, has a critical CVSS score, and is in CISA KEV. Focus on fast patch deployment and verification rather than extended analysis.
Technical view
The issue is a CWE-416 use-after-free in Chrome Visuals before 124.0.6367.201. The CVE describes potential sandbox escape from a compromised renderer via crafted HTML. CVSS is 9.6 with network attack vector, low complexity, required user interaction, changed scope, and high confidentiality, integrity, and availability impact.
Likely exposure
Systems running Google Chrome versions earlier than 124.0.6367.201 are the clearest exposure. Fedora Chromium package advisories indicate downstream Chromium builds also needed updates. Evidence provided does not establish impact for every Chromium-based browser, so verify each vendor separately.
Exploitation context
Active exploitation is supported by CISA KEV listing. The source bundle does not provide exploit details, campaign scope, targets, or proof-of-concept availability. The attack requires user interaction and an already compromised renderer, but the outcome can be sandbox escape.
Researcher notes
Focus validation on version evidence and update state. The public description names Visuals use-after-free and sandbox escape conditions, but does not disclose technical internals. Do not infer exploit chains beyond renderer compromise plus crafted HTML.
Mitigation direction
- Update Google Chrome to 124.0.6367.201 or later immediately.
- Apply Fedora Chromium security updates where Fedora packages are used.
- Force browser relaunch after update so patched binaries are active.
- Prioritize managed endpoints, VDI images, kiosks, and high-risk user groups.
- Check vendor guidance for other Chromium-based browsers before assuming coverage.
Validation and detection
- Inventory Chrome versions across endpoints and servers with browser components.
- Flag any Chrome version earlier than 124.0.6367.201 as vulnerable.
- Confirm update policy reports show installation and post-update restart.
- Review Fedora package status against the listed Fedora advisories.
- Track CISA KEV remediation status in vulnerability management records.
Public sources used
- CVE Program
- CVE List V5
- Chrome Releases
- Chromium Issue
- Fedora Advisory NTSN22LNYXMWHVTYNOYQVOY7VDZFHENQ
- Fedora Advisory FAWEKDQTHPN7NFEMLIWP7YMIZ2DHF36N
- Fedora Advisory WSUWM73ZCXTN62AT2REYQDD5ZKPFMDZD
- Fedora Advisory 6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN
- Fedora Advisory BWFSZNNWSQYDRYKNLBDGEXXKMBXDYQ3F
- CISA Known Exploited Vulnerabilities Catalog
Michael Williams reviewed this cited source version on .
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-416: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupPrivilege behavior lookup
The CVE wording references privilege impact, so privilege escalation and authorization behavior review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2024-4671 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.6 (3.1)
- Known Exploited
- Yes
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CISA KEV status
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H2.86Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
9.6CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://chromereleases.googleblog.com/2024/05/stable-channel-update-for-desktop_9.htmlCVE reference
- https://issues.chromium.org/issues/339266700CVE reference
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NTSN22LNYXMWHVTYNOYQVOY7VDZFHENQ/CVE reference
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FAWEKDQTHPN7NFEMLIWP7YMIZ2DHF36N/CVE reference
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WSUWM73ZCXTN62AT2REYQDD5ZKPFMDZD/CVE reference
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/CVE reference
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BWFSZNNWSQYDRYKNLBDGEXXKMBXDYQ3F/CVE reference
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-4671CVE reference · government-resource
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Use After Free
Use After Free represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.