CVE-2024-11113: Google Chrome Use After Free Vulnerability

CVE-2024-11113 Overview

CVE-2024-11113 is a use-after-free vulnerability in the Accessibility component of Google Chrome versions prior to 131.0.6778.69. A remote attacker who has already compromised the renderer process can exploit heap corruption through a crafted HTML page. Google classifies the Chromium security severity as Medium, while the NVD assigns a CVSS 3.1 base score of 8.8 due to the network attack vector and high impact on confidentiality, integrity, and availability. The weakness is tracked as CWE-416: Use After Free. No public proof-of-concept exploit or in-the-wild exploitation has been reported at the time of publication.

Critical Impact
An attacker with an already-compromised renderer process can trigger heap corruption in the browser process, enabling potential sandbox escape and code execution on the host.

Affected Products

Google Chrome Desktop versions prior to 131.0.6778.69
Chromium-based browsers embedding the vulnerable Accessibility component
All supported desktop platforms (Windows, macOS, Linux)

Discovery Timeline

2024-11-12 - CVE-2024-11113 published to NVD
2024-11-12 - Google releases Stable Channel update 131.0.6778.69 addressing the issue
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-11113

Vulnerability Analysis

The flaw resides in Chrome's Accessibility subsystem, which builds an accessibility tree that mirrors the DOM for assistive technologies. A use-after-free condition [CWE-416] occurs when the code retains a reference to an accessibility object that has already been freed. Subsequent access to the dangling pointer allows the attacker to manipulate heap memory contents.

Exploitation requires the attacker to first compromise the renderer process, typically by chaining an earlier bug reachable through a crafted HTML page. Once inside the renderer, the attacker triggers accessibility events that reach the browser process, where the use-after-free enables heap corruption. Successful exploitation can lead to a sandbox escape and arbitrary code execution outside the renderer sandbox.

Root Cause

The root cause is improper lifetime management of accessibility objects. Chrome's Accessibility code frees an object while other components still hold references to it. When those stale references are dereferenced, the freed memory may have been reallocated with attacker-controlled data, giving the attacker influence over control-flow or object metadata.

Attack Vector

The attack vector is network-based and requires user interaction, such as visiting a malicious website. The attacker must have chained a prior renderer compromise. Because Accessibility runs across the renderer/browser boundary, corruption in this component is a common target for sandbox-escape chains. See the Chromium Issue Tracker Entry and the Google Chrome Desktop Update for vendor details.

Detection Methods for CVE-2024-11113

Indicators of Compromise

Chrome renderer or browser process crashes with heap corruption signatures in Windows Error Reporting or macOS crash logs
Unexpected child processes spawned by chrome.exe or Google Chrome Helper
Outbound connections from Chrome processes to previously unseen domains immediately after a crash event
Browser installations reporting versions earlier than 131.0.6778.69 across managed endpoints

Detection Strategies

Inventory installed Chrome versions using endpoint telemetry and flag any host running a build below 131.0.6778.69
Monitor for anomalous process trees originating from Chrome, especially command interpreters or scripting engines spawned by the browser
Correlate browser crash telemetry with subsequent process creation, file write, or persistence events on the same host

Monitoring Recommendations

Ingest browser process telemetry and crash events into a centralized SIEM or data lake for correlation
Alert on Chrome processes performing unusual file system writes to startup, scheduled task, or LaunchAgent paths
Track network connections from browser processes to newly registered or low-reputation domains

How to Mitigate CVE-2024-11113

Immediate Actions Required

Update Google Chrome to version 131.0.6778.69 or later on all managed endpoints
Restart the browser after update to ensure the patched binaries are loaded into memory
Audit Chromium-based browsers and embedded WebView components for downstream patch availability

Patch Information

Google addressed the vulnerability in the Stable Channel update released on 2024-11-12. The fix is included in Chrome 131.0.6778.69 for Windows, macOS, and Linux. Refer to the Google Chrome Desktop Update advisory for full release notes and platform-specific version numbers.

Workarounds

Enforce automatic updates through the Chrome Enterprise policy UpdateDefault to reduce time-to-patch
Restrict browsing to trusted sites via URL allowlists until patch deployment completes
Consider temporarily disabling accessibility integrations for users who do not require them, using group policy controls

bash

# Verify installed Chrome version on Windows endpoints
reg query "HKLM\SOFTWARE\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv

# Verify installed Chrome version on macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Verify installed Chrome version on Linux
google-chrome --version