CVE-2024-1060: Google Chrome Use After Free Vulnerability

CVE-2024-1060 Overview

CVE-2024-1060 is a use-after-free vulnerability [CWE-416] in the Canvas component of Google Chrome versions prior to 121.0.6167.139. A remote attacker can trigger heap corruption by serving a crafted HTML page to a victim. Successful exploitation may lead to arbitrary code execution within the renderer process. Google rated the Chromium security severity as High, and the CVSS 3.1 base score is 8.8. Fedora 38 and Fedora 39 distributions packaging Chromium are also affected and received updates through Fedora package announcements.

Critical Impact
Remote attackers can achieve heap corruption and potential code execution in the Chrome renderer by luring users to a crafted web page.

Affected Products

Google Chrome versions prior to 121.0.6167.139
Fedora 38 (Chromium package)
Fedora 39 (Chromium package)

Discovery Timeline

2024-01-30 - Google publishes the Stable Channel update for desktop addressing this issue
2024-01-30 - CVE-2024-1060 published to NVD
2025-05-29 - Last updated in NVD database

Technical Details for CVE-2024-1060

Vulnerability Analysis

The vulnerability resides in Chrome's Canvas implementation, which provides the HTML5 2D drawing surface used by web pages through the <canvas> element. A use-after-free condition occurs when the renderer continues to access a Canvas-related heap object after it has been freed. An attacker who controls the lifetime of that object can groom the heap, place attacker-controlled data in the freed slot, and dereference a dangling pointer.

Exploitation of use-after-free bugs in Blink and Skia-backed Canvas code commonly leads to type confusion or controlled writes, which adversaries chain with information leaks to bypass ASLR and achieve renderer code execution. From the renderer, attackers typically pivot to a sandbox escape to compromise the host. The bug is exploitable over the network and requires user interaction such as visiting a malicious page.

Root Cause

The root cause is improper object lifetime management in Canvas [CWE-416]. A reference to a heap-allocated Canvas object is retained and used after the object has been released, leaving a dangling pointer that an attacker can reclaim with controlled data. Detailed reproduction information is restricted in Chromium Bug Report #1511567.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker hosts a crafted HTML page that exercises specific Canvas APIs to free and then reuse an object. When a user visits the page using a vulnerable Chrome build, the renderer executes the attacker's JavaScript and triggers the heap corruption. No authentication is needed.

No verified public proof-of-concept is currently referenced for this CVE. See the Chrome Desktop Update Notice for the vendor advisory.

Detection Methods for CVE-2024-1060

Indicators of Compromise

Chrome renderer process crashes with heap corruption signatures while a <canvas> element is in use
Outbound connections from browser hosts to newly registered or low-reputation domains immediately preceding renderer crashes
Unexpected child processes spawned by chrome.exe following the loading of an untrusted HTML page
Browser telemetry showing Chrome versions below 121.0.6167.139 still active in the environment

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag any build earlier than 121.0.6167.139
Correlate web proxy logs with endpoint crash events to identify users redirected to suspicious pages prior to renderer faults
Hunt for anomalous process trees where Chrome renderer processes load unusual DLLs or invoke shell utilities
Monitor for Chromium repackaged binaries on Fedora 38 and 39 hosts that have not received the patched package

Monitoring Recommendations

Enable browser crash reporting and forward Watson or Crashpad telemetry to your SIEM for triage
Track DNS and HTTP requests to domains hosting heavy JavaScript Canvas workloads from unmanaged sources
Alert on Chrome version drift in patch management dashboards on a daily cadence
Centralize Fedora dnf update logs to verify Chromium package versions match advisory levels

How to Mitigate CVE-2024-1060

Immediate Actions Required

Update Google Chrome to version 121.0.6167.139 or later on all Windows, macOS, and Linux endpoints
Apply the patched Chromium packages on Fedora 38 and Fedora 39 hosts using dnf update
Restart browser sessions after patch deployment to ensure the vulnerable process image is unloaded
Verify enterprise managed browser policies are enforcing automatic updates

Patch Information

Google released the fix in the Stable Channel update for desktop on January 30, 2024, shipping Chrome 121.0.6167.139 for Mac and Linux and 121.0.6167.139/140 for Windows. Fedora published corresponding Chromium package updates through the Fedora Package Announcement for F38 and the Fedora Package Announcement for F39. Full vendor guidance is available in the Chrome Desktop Update Notice.

Workarounds

Restrict browsing to trusted sites using web filtering until patches are deployed across the fleet
Disable JavaScript on untrusted origins through enterprise policy where business workflows permit
Use site isolation and ensure the Chrome sandbox is enabled to contain renderer compromises
Deploy application allowlisting to block execution of unexpected binaries dropped by a compromised renderer

bash

# Verify Chrome version on Linux endpoints
google-chrome --version

# Update Chromium on Fedora
sudo dnf upgrade --refresh chromium

# Confirm installed version meets the fixed build
rpm -q chromium