CVE-2024-0813: Google Chrome Use-After-Free Vulnerability

CVE-2024-0813 Overview

CVE-2024-0813 is a use-after-free vulnerability in the Reading Mode component of Google Chrome versions prior to 121.0.6167.85. An attacker who convinces a user to install a malicious extension can trigger heap corruption through specific UI interactions. The flaw is tracked under CWE-416 and affects Chrome on all desktop platforms along with Fedora 38 and 39 distributions that ship Chromium-based packages.

Google assigned the issue a Chromium security severity of Medium, while NVD scores it 8.8 (High). Exploitation requires user interaction, specifically the installation of a crafted extension.

Critical Impact
Successful exploitation can lead to heap corruption and arbitrary code execution within the renderer process, enabling sandbox-bound code execution on affected systems.

Affected Products

Google Chrome versions prior to 121.0.6167.85
Fedora 38 (Chromium packages)
Fedora 39 (Chromium packages)

Discovery Timeline

2024-01-24 - CVE-2024-0813 published to NVD
2024-01-23 - Google releases stable channel update Stable Channel Update for Desktop
2025-06-20 - Last updated in NVD database

Technical Details for CVE-2024-0813

Vulnerability Analysis

The vulnerability is a use-after-free condition in Chrome's Reading Mode feature. Reading Mode is a built-in distillation feature that reformats web page content for easier reading. The flaw allows freed heap memory to be referenced through subsequent UI interactions, leading to heap corruption.

Use-after-free conditions arise when a program continues to use a pointer after the underlying memory has been deallocated. In Chrome's renderer process, this typically allows attackers to influence object reuse and gain control of execution within the sandbox.

The attack vector is network-based with low complexity, but requires user interaction. The attacker must convince the target to install a malicious browser extension. Once installed, the extension drives the UI states required to free and re-reference the vulnerable object.

Root Cause

The root cause is improper lifetime management of an object in the Reading Mode subsystem. A reference to the object persists after deallocation, and a specific sequence of UI events triggers reuse of the dangling pointer. Internal tracking for this issue is recorded in Chromium Bug 1477151.

Attack Vector

Exploitation requires the victim to install a malicious extension granted access to the Reading Mode surface. The extension then performs scripted UI interactions to trigger the dangling pointer condition. Heap corruption can then be groomed into renderer code execution, which an attacker may chain with a separate sandbox escape to fully compromise the host.

No public proof-of-concept code has been published for CVE-2024-0813. The vulnerability mechanism is described in the Chromium bug tracker entry referenced above.

Detection Methods for CVE-2024-0813

Indicators of Compromise

Chrome renderer process crashes referencing Reading Mode (distiller) components in crash dumps
Recently installed browser extensions from untrusted sources requesting broad page access permissions
Unexpected child process creation from chrome.exe following extension installation
Outbound connections from Chrome to unfamiliar domains immediately after Reading Mode invocation

Detection Strategies

Inventory installed Chrome extensions across managed endpoints and flag those not present in the corporate allowlist
Monitor Chrome version telemetry to identify endpoints running builds earlier than 121.0.6167.85
Correlate renderer crash events with extension install events to surface potential exploitation attempts

Monitoring Recommendations

Forward Chrome management policy logs and extension install events to a centralized SIEM for review
Track process lineage from chrome.exe to catch anomalous child processes or injected modules
Alert on Chrome auto-update failures so unpatched browsers do not remain in production

How to Mitigate CVE-2024-0813

Immediate Actions Required

Update Google Chrome to version 121.0.6167.85 or later on all desktop endpoints
Apply Fedora package updates for Chromium on Fedora 38 and 39 systems
Audit installed extensions and remove any that are unsigned, sideloaded, or untrusted
Restart browsers after patch deployment to ensure the updated binary is loaded

Patch Information

Google addressed CVE-2024-0813 in the Chrome stable channel release announced on January 23, 2024. Full details are available in the Google Chrome Update Announcement. Fedora users should apply the updates published in the Fedora 38 advisory and Fedora 39 advisory.

Workarounds

Enforce an extension allowlist via Chrome Enterprise policy ExtensionInstallAllowlist to block untrusted add-ons
Disable extension installation entirely on high-risk endpoints using ExtensionInstallBlocklist set to *
Train users to install extensions only from verified publishers in the Chrome Web Store

bash

# Chrome Enterprise policy example to block all extensions except an allowlist
# Linux: /etc/opt/chrome/policies/managed/extensions.json
{
  "ExtensionInstallBlocklist": ["*"],
  "ExtensionInstallAllowlist": [
    "<approved-extension-id-1>",
    "<approved-extension-id-2>"
  ]
}