CVE-2024-0223 Overview
CVE-2024-0223 is a heap buffer overflow vulnerability in ANGLE (Almost Native Graphics Layer Engine), the graphics abstraction layer used by Google Chrome to translate WebGL and other OpenGL ES API calls. The flaw affects Google Chrome versions prior to 120.0.6099.199. A remote attacker can trigger heap corruption by convincing a user to visit a crafted HTML page. Chromium classified the security severity as High. The issue is tracked under [CWE-787] (Out-of-bounds Write) and is also addressed in Fedora 38 and Fedora 39 distributions that ship Chromium-derived components.
Critical Impact
Successful exploitation can lead to heap corruption in the browser process, potentially enabling arbitrary code execution within the renderer sandbox after a single visit to a malicious web page.
Affected Products
- Google Chrome versions prior to 120.0.6099.199
- Fedora 38
- Fedora 39
Discovery Timeline
- 2024-01-04 - CVE-2024-0223 published to NVD
- 2025-06-18 - Last updated in NVD database
Technical Details for CVE-2024-0223
Vulnerability Analysis
The vulnerability resides in ANGLE, which implements OpenGL ES on top of native graphics APIs such as Direct3D, Metal, and Vulkan. ANGLE processes WebGL commands originating from untrusted web content. A heap buffer overflow in this component allows out-of-bounds writes on the heap when handling crafted graphics input. Exploitation requires user interaction in the form of visiting a malicious HTML page. Because ANGLE runs in the GPU process and interacts with renderer-supplied data, memory corruption here can be chained with sandbox escapes to achieve broader system compromise. The bug is tracked publicly as Chrome Bug Report #1505009.
Root Cause
The defect is an out-of-bounds write on heap-allocated memory ([CWE-787]) inside ANGLE's command processing path. Insufficient bounds validation on attacker-controlled graphics parameters allows a write to extend past the bounds of an allocated heap buffer, corrupting adjacent heap metadata or object data.
Attack Vector
The attack vector is network-based and requires user interaction. An attacker hosts a crafted HTML page that issues malicious WebGL or graphics API calls when rendered. Once a victim visits the page in a vulnerable Chrome build, the malformed graphics input drives ANGLE into an out-of-bounds write condition. No authentication is required, and the attacker does not need prior access to the target system.
Google has not released technical exploitation details for this issue. Refer to the Google Chrome Update Announcement and the Chrome Bug Report #1505009 for vendor-confirmed information.
Detection Methods for CVE-2024-0223
Indicators of Compromise
- Chrome or Chromium renderer or GPU process crashes with heap corruption signatures shortly after browsing untrusted sites.
- Browser telemetry showing unexpected child process spawns or shellcode-like execution patterns originating from chrome.exe GPU process.
- Network connections to attacker-controlled domains immediately following a browser crash event.
Detection Strategies
- Inventory Chrome installations and flag any host running a version earlier than 120.0.6099.199.
- Monitor for abnormal child processes created by Chrome's GPU or renderer processes, which may indicate post-exploitation activity.
- Correlate browser crash dumps with web traffic logs to identify potential exploitation attempts against vulnerable endpoints.
Monitoring Recommendations
- Enable endpoint logging for process creation, module loads, and memory protection changes on hosts running Chrome.
- Forward Chrome crash telemetry and DNS query logs to a centralized SIEM for retrospective hunting.
- Track outbound HTTPS connections from Chrome to newly observed or low-reputation domains following crash events.
How to Mitigate CVE-2024-0223
Immediate Actions Required
- Update Google Chrome to version 120.0.6099.199 or later on all managed endpoints.
- Apply Fedora package updates referenced in the Fedora package announcements for Fedora 38 and Fedora 39.
- Restart Chrome after patching to ensure the vulnerable ANGLE component is unloaded from memory.
- Verify deployment status through enterprise patch management consoles before closing the remediation ticket.
Patch Information
Google addressed CVE-2024-0223 in Chrome 120.0.6099.199 as documented in the Google Chrome Update Announcement. Fedora users should apply the updates referenced by the project's package announcement. Gentoo users should review GLSA 202401-34 for distribution-specific upgrade guidance.
Workarounds
- Restrict browsing to trusted sites until patches are deployed, using web filtering or proxy enforcement.
- Disable hardware acceleration in Chrome settings to reduce reliance on ANGLE code paths, accepting the performance trade-off.
- Enforce strict site isolation and keep Chrome's sandbox enabled to limit the blast radius of successful exploitation.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
