CVE-2024-1077: Google Chrome Use-After-Free Vulnerability

CVE-2024-1077 Overview

CVE-2024-1077 is a use-after-free vulnerability in the Network component of Google Chrome versions prior to 121.0.6167.139. A remote attacker can exploit heap corruption by enticing a user to open a malicious file or visit a crafted web page. Google rated the Chromium security severity as High. The flaw is tracked under [CWE-416: Use After Free] and affects desktop builds of Chrome across supported platforms. Fedora 38 and Fedora 39 distributions that ship Chromium-based packages are also impacted.

Critical Impact
Successful exploitation can lead to heap corruption, enabling arbitrary code execution within the browser process and potential sandbox escape chains.

Affected Products

Google Chrome prior to 121.0.6167.139
Fedora 38
Fedora 39

Discovery Timeline

2024-01-30 - CVE-2024-1077 published to NVD
2024-01-30 - Google releases Stable Channel update for Desktop
2025-06-03 - Last updated in NVD database

Technical Details for CVE-2024-1077

Vulnerability Analysis

The vulnerability resides in the Network component of Chrome's Chromium codebase. A use-after-free condition occurs when the Network subsystem references memory that has already been freed during the handling of specific resources. An attacker who serves a malicious file or hosts a crafted page can trigger the dangling pointer condition. Once the freed heap region is reclaimed with attacker-controlled data, the resulting memory corruption can be leveraged to hijack control flow inside the renderer or network service process.

The attack vector is network-based and requires user interaction, such as opening a file or visiting a website. The scope is unchanged, but confidentiality, integrity, and availability impacts are all rated high because successful exploitation yields code execution within the affected Chrome process.

Root Cause

The defect is classified under [CWE-416] (Use After Free). The Network component fails to invalidate or properly synchronize a pointer to a heap object after the object's lifetime ends. Subsequent operations dereference the stale pointer, leading to heap corruption. Details remain restricted in the Chromium Bug Report #1511085 until a majority of users are updated.

Attack Vector

Exploitation requires a remote attacker to deliver a malicious file or web resource. The user must interact with the content, for example by loading the file in Chrome or navigating to an attacker-controlled URL. Once triggered, the heap corruption primitive can be combined with additional bugs to achieve arbitrary code execution and, potentially, a sandbox escape.

No public proof-of-concept code is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Verified code examples are not available, so technical specifics remain limited to the vendor's advisory.

Detection Methods for CVE-2024-1077

Indicators of Compromise

Unexpected Chrome renderer or network service crashes correlated with browsing activity, particularly with EXCEPTION_ACCESS_VIOLATION or heap corruption signatures.
Chrome processes spawning unusual child processes such as cmd.exe, powershell.exe, or shell utilities following a browsing session.
Outbound connections from chrome.exe to uncategorized or newly registered domains immediately after loading attacker-supplied content.

Detection Strategies

Inventory installed Chrome versions across the fleet and flag any build below 121.0.6167.139 for remediation tracking.
Hunt for browser exploitation behaviors such as renderer-to-LOLBin process chains, unsigned module loads into chrome.exe, and anomalous network service crashes.
Correlate web proxy logs with endpoint telemetry to identify users who accessed suspicious files or URLs before a Chrome crash event.

Monitoring Recommendations

Forward Chrome crash reports and Windows Error Reporting events to the SIEM for centralized triage.
Monitor EDR telemetry for child processes of chrome.exe that deviate from normal browser behavior baselines.
Track patch compliance via configuration management tooling and alert on hosts running outdated Chrome builds.

How to Mitigate CVE-2024-1077

Immediate Actions Required

Update Google Chrome to version 121.0.6167.139 or later on all Windows, macOS, and Linux endpoints.
Apply the corresponding Fedora chromium package updates on Fedora 38 and Fedora 39 systems.
Restart browsers after patching to ensure the vulnerable process is no longer resident in memory.
Verify auto-update is enabled and functioning on managed endpoints to reduce exposure to future Chrome flaws.

Patch Information

Google addressed the issue in the Stable Channel update released on January 30, 2024. Refer to the Google Chrome Update Announcement for the official release notes. Fedora users should consult the Fedora 38 Package Announcement and Fedora 39 Package Announcement for distribution-specific guidance.

Workarounds

No vendor-supplied workaround exists. Patching is the only supported remediation path.
Restrict user access to untrusted file downloads and web content through web proxy categorization and email gateway controls until patches are deployed.
Enforce browser isolation or sandboxing technologies for high-risk user groups who cannot patch immediately.

bash

# Verify installed Chrome version on Linux/macOS
google-chrome --version

# Update Chromium on Fedora
sudo dnf update -y chromium

# Windows: confirm version via registry
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv