CVE-2024-1059: Google Chrome Use After Free Vulnerability

CVE-2024-1059 Overview

CVE-2024-1059 is a use-after-free vulnerability [CWE-416] in the Peer Connection component of Google Chrome. The flaw affects Chrome versions prior to 121.0.6167.139 and allows a remote attacker to potentially exploit stack corruption through a crafted HTML page. Successful exploitation requires user interaction, such as visiting a malicious website. Google classified the Chromium security severity as High, and the issue also impacted Fedora 38 and Fedora 39 Chromium packages.

Critical Impact
A remote attacker can trigger stack corruption in the Chrome renderer, potentially leading to arbitrary code execution within the sandboxed process when a victim loads attacker-controlled content.

Affected Products

Google Chrome versions prior to 121.0.6167.139
Fedora 38 Chromium packages
Fedora 39 Chromium packages

Discovery Timeline

2024-01-30 - Google releases stable channel update addressing CVE-2024-1059
2024-01-30 - CVE-2024-1059 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-1059

Vulnerability Analysis

The vulnerability resides in the Peer Connection implementation, part of Chrome's WebRTC stack that handles real-time peer-to-peer audio, video, and data channels. A use-after-free condition occurs when the renderer references memory that has already been freed during peer connection lifecycle handling. An attacker who controls the page can manipulate object allocation and destruction to dereference a dangling pointer.

Because WebRTC APIs are accessible from JavaScript without elevated permissions, any malicious or compromised web page can reach the vulnerable code path. The condition can lead to stack corruption, which an attacker can shape into control-flow hijacking within the renderer process. Exploitation typically targets type confusion or vtable manipulation through reclaimed memory.

Root Cause

The root cause is improper object lifetime management within the Peer Connection code. Reference tracking fails to prevent access to a freed object during certain state transitions or callback sequences. The CWE-416 classification reflects this pattern of operating on memory after it has been released back to the allocator.

Attack Vector

Exploitation occurs over the network and requires user interaction. A victim must load a crafted HTML page that invokes the WebRTC Peer Connection API in a specific sequence to trigger the freed-object access. No authentication is required, and the attack surface is reachable from any origin that the user visits.

No verified proof-of-concept is publicly available. Technical details about the underlying flaw are tracked in the restricted Chromium Bug Report #1514777, which remains gated while downstream distributors complete patching.

Detection Methods for CVE-2024-1059

Indicators of Compromise

Chrome renderer process crashes referencing WebRTC, PeerConnection, or libwebrtc modules in crash dumps.
Outbound connections from browser hosts to unexpected STUN, TURN, or signaling endpoints initiated by untrusted pages.
Browser telemetry showing Chrome versions older than 121.0.6167.139 on managed endpoints.

Detection Strategies

Inventory installed Chrome versions across the fleet and flag any build below 121.0.6167.139 as vulnerable.
Correlate web proxy logs with renderer crash events to identify pages that consistently destabilize Chrome.
Hunt for child processes or shellcode execution chains originating from chrome.exe renderer instances following navigation events.

Monitoring Recommendations

Enable enterprise reporting through Chrome Browser Cloud Management to centralize version, crash, and extension telemetry.
Forward endpoint process and network telemetry to a SIEM and alert on anomalous post-exploitation behavior chained to the browser.
Track Google's Stable Channel Update for Desktop blog to align detection content with vendor disclosures.

How to Mitigate CVE-2024-1059

Immediate Actions Required

Update Google Chrome to version 121.0.6167.139 or later on Windows, macOS, and Linux endpoints.
Restart Chrome after the update completes so the patched binary is loaded into memory.
For Fedora hosts, apply the Chromium updates referenced in the Fedora package announcements.
Audit any Chromium-based embedded browsers and downstream forks for backported fixes.

Patch Information

Google addressed CVE-2024-1059 in the Stable Channel update released on January 30, 2024, shipping Chrome 121.0.6167.139 for desktop platforms. Fedora 38 and Fedora 39 received corresponding Chromium package updates through the Fedora updates repository. Administrators should confirm patch deployment by checking chrome://version or querying installed package versions.

Workarounds

Restrict access to untrusted websites through enterprise web filtering until patching is complete.
Disable WebRTC in managed Chrome policies where the feature is not required for business workflows.
Enforce Site Isolation and the Chrome sandbox, which remain enabled by default and reduce the impact of renderer compromise.

bash

# Verify patched Chrome version on Linux endpoints
google-chrome --version

# Fedora: update Chromium packages
sudo dnf upgrade --refresh chromium

# Windows: enforce minimum Chrome version via Group Policy registry key
reg add "HKLM\Software\Policies\Google\Chrome" /v MinimumVersion /t REG_SZ /d "121.0.6167.139" /f