CVE-2024-0222: Google Chrome Use After Free Vulnerability

CVE-2024-0222 Overview

CVE-2024-0222 is a use-after-free vulnerability in ANGLE, the graphics abstraction layer used by Google Chrome to translate OpenGL ES API calls to platform-specific graphics APIs. The flaw affects Google Chrome versions prior to 120.0.6099.199. A remote attacker who has already compromised the renderer process can trigger heap corruption by delivering a crafted HTML page. Successful exploitation may lead to code execution within the browser sandbox context. Google rated the Chromium security severity as High, and the issue is tracked under [CWE-416].

Critical Impact
Remote attackers with renderer compromise can exploit heap corruption in ANGLE to escalate control within Chrome, potentially chaining to sandbox escape.

Affected Products

Google Chrome versions prior to 120.0.6099.199
Fedora 38
Fedora 39

Discovery Timeline

2024-01-04 - CVE-2024-0222 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-0222

Vulnerability Analysis

ANGLE (Almost Native Graphics Layer Engine) translates WebGL and OpenGL ES calls into Direct3D, Metal, Vulkan, or desktop OpenGL commands. The component executes in Chrome's renderer process and handles complex graphics state objects with reference-counted lifetimes.

The vulnerability arises when ANGLE frees a heap object while other code paths retain references to it. Subsequent access to the dangling pointer produces heap corruption. An attacker who controls the renderer, typically through a prior renderer bug, can shape the heap and trigger the dangling reference through crafted WebGL operations served from an HTML page.

Heap corruption in the renderer becomes valuable when combined with a sandbox escape primitive. The bug expands the attack surface available to adversaries chaining multiple flaws in browser exploit chains.

Root Cause

The root cause is a use-after-free condition [CWE-416] in ANGLE object lifetime management. Reference tracking fails to prevent access to freed graphics resources, leaving stale pointers accessible to attacker-controlled code paths in the renderer.

Attack Vector

Exploitation requires the attacker to first compromise the renderer process, then deliver a crafted HTML page that invokes the vulnerable ANGLE code path. User interaction is required, as the victim must load the malicious page. See the Chromium Bug Report #1501798 for tracking details.

Detection Methods for CVE-2024-0222

Indicators of Compromise

Chrome renderer processes crashing with heap corruption signatures during WebGL or graphics-heavy page loads
Outbound connections from Chrome to untrusted domains hosting HTML pages with unusual WebGL shader payloads
Anomalous child process creation from chrome.exe following visits to attacker-controlled sites

Detection Strategies

Inventory installed Chrome versions across the fleet and flag any instance below 120.0.6099.199
Monitor endpoint telemetry for Chrome renderer crashes correlated with GPU process activity
Correlate browser process telemetry with network destinations to identify visits to known exploit-hosting infrastructure

Monitoring Recommendations

Enable EDR visibility into browser child processes and GPU sandbox exits
Alert on Chrome updates that fail to apply on managed endpoints, leaving hosts on vulnerable builds
Aggregate browser version data centrally to measure exposure and remediation progress

How to Mitigate CVE-2024-0222

Immediate Actions Required

Update Google Chrome to version 120.0.6099.199 or later on all endpoints
Apply Fedora package updates referenced in the Fedora Package Announcement
Gentoo administrators should apply Gentoo GLSA 202401-34
Restart Chrome after patching to ensure the new binary is loaded

Patch Information

Google released the fix in the Stable Channel update announced in the Chrome Blog Update. Chrome versions 120.0.6099.199 and later contain the corrected ANGLE object lifetime handling. Fedora 38 and Fedora 39 shipped patched Chromium packages through their standard update channels.

Workarounds

Enforce enterprise policy to auto-update Chrome and prevent users from disabling updates
Restrict browsing to trusted sites via allowlists where feasible until patches are deployed
Disable hardware acceleration in Chrome as a partial mitigation to reduce ANGLE code path exposure, accepting the performance tradeoff

bash

# Verify Chrome version on Linux endpoints
google-chrome --version

# Fedora patch application
sudo dnf update chromium

# Windows enterprise policy to enforce auto-update (registry)
reg add "HKLM\SOFTWARE\Policies\Google\Update" /v UpdateDefault /t REG_DWORD /d 1 /f