CVE-2024-0812: Google Chrome RCE Vulnerability

CVE-2024-0812 Overview

CVE-2024-0812 is an inappropriate implementation vulnerability in the Accessibility component of Google Chrome prior to version 121.0.6167.85. This flaw allows a remote attacker to potentially exploit object corruption via a crafted HTML page. Chromium has classified this vulnerability with a security severity rating of High.

Critical Impact

A remote attacker can exploit object corruption through a specially crafted HTML page, potentially leading to arbitrary code execution, unauthorized data access, or complete system compromise when a user visits a malicious website.

Affected Products

• Google Chrome versions prior to 121.0.6167.85
• Fedora Project Fedora 38
• Fedora Project Fedora 39

Discovery Timeline

• January 24, 2024 - CVE-2024-0812 published to NVD
• May 30, 2025 - Last updated in NVD database

Technical Details for CVE-2024-0812

Vulnerability Analysis

This vulnerability stems from an inappropriate implementation in Chrome's Accessibility component. The Accessibility features in modern browsers provide interfaces that allow assistive technologies to interact with web content. When these interfaces improperly handle certain operations, it can lead to object corruption—a condition where internal object state becomes inconsistent or points to invalid memory regions.

Object corruption vulnerabilities are particularly dangerous in browser contexts because they can serve as primitives for more sophisticated attacks, potentially allowing attackers to achieve arbitrary code execution within the browser sandbox. The network-accessible nature of this vulnerability means it can be triggered simply by convincing a user to visit a malicious webpage, requiring no special privileges from the attacker.

Root Cause

The root cause lies in an inappropriate implementation within Chrome's Accessibility subsystem. When processing certain accessibility-related operations triggered by crafted HTML content, the browser fails to properly validate or handle object states, leading to corruption. This type of implementation flaw typically occurs when:

• Object lifecycle management is not properly synchronized with accessibility tree updates
• Memory safety checks are bypassed during accessibility interface operations
• Race conditions exist between accessibility event handlers and DOM modifications

Attack Vector

The attack vector is network-based and requires user interaction. An attacker must craft a malicious HTML page designed to trigger the vulnerable code path in Chrome's Accessibility component. The attack scenario typically follows this pattern:

1. The attacker creates a specially crafted HTML page containing elements that trigger specific accessibility operations
2. The victim is lured to visit the malicious page through phishing, malvertising, or compromised websites
3. When the browser renders the page and processes accessibility-related operations, object corruption occurs
4. The corrupted object state can be leveraged to achieve further exploitation, potentially escaping the browser's security boundaries

The vulnerability does not require the user to have accessibility features explicitly enabled, as browsers maintain accessibility interfaces for potential use by assistive technologies.

Detection Methods for CVE-2024-0812

Indicators of Compromise

• Unexpected browser crashes or instability when visiting certain websites
• Anomalous memory consumption patterns in Chrome processes
• Detection of known malicious HTML patterns targeting accessibility APIs
• Browser process spawning unexpected child processes

Detection Strategies

• Deploy endpoint detection solutions capable of monitoring browser process behavior for signs of exploitation
• Implement network-level monitoring to detect connections to known malicious domains serving exploit content
• Enable Chrome crash reporting to identify potential exploitation attempts through crash telemetry
• Monitor for unusual accessibility API invocations through browser audit logging

Monitoring Recommendations

• Utilize SentinelOne's behavioral AI to detect anomalous browser activity indicative of exploitation attempts
• Implement web filtering to block access to domains known to host browser exploits
• Configure centralized logging for Chrome enterprise deployments to correlate potential attack patterns
• Enable browser telemetry collection for security event correlation and threat hunting

How to Mitigate CVE-2024-0812

Immediate Actions Required

• Update Google Chrome to version 121.0.6167.85 or later immediately
• Enable automatic browser updates to ensure timely patching of future vulnerabilities
• For Fedora 38 and 39 users, apply the latest security updates from the Fedora repositories
• Review endpoint protection configurations to ensure browser process monitoring is enabled

Patch Information

Google has released Chrome version 121.0.6167.85 which addresses this vulnerability. The fix was announced in the Chrome Desktop Stable Channel Update on January 23, 2024. Additional technical details are tracked in Chromium Bug Report #1484394.

Fedora users should apply the security updates announced in the Fedora Package Announcements for their respective Fedora versions.

Workarounds

• If immediate patching is not possible, consider restricting browsing to trusted websites only
• Implement web content filtering to block potentially malicious HTML content
• Disable or restrict Chrome extensions that may interact with accessibility features
• Use browser isolation technologies to contain potential exploitation within a sandboxed environment
• Consider using browser policies to restrict access to high-risk websites until patching is complete

# Verify Chrome version on Linux systems
google-chrome --version

# Update Chrome on Fedora
sudo dnf update chromium

# Check for available updates on Fedora
sudo dnf check-update chromium