CVE-2024-1284 Overview
CVE-2024-1284 is a use-after-free vulnerability in the Mojo inter-process communication (IPC) component of Google Chrome before version 121.0.6167.160. A remote attacker can exploit heap corruption by serving a crafted HTML page to a target browser. Successful exploitation can lead to arbitrary code execution within the renderer process and may be chained with sandbox escapes to compromise the host. The flaw is tracked under CWE-416: Use After Free and affects both upstream Google Chrome and downstream Fedora Linux packages.
Critical Impact
Remote attackers can trigger heap corruption through a crafted web page, enabling potential code execution in the browser process with no user authentication required.
Affected Products
- Google Chrome versions prior to 121.0.6167.160
- Fedora 38 (chromium package)
- Fedora 39 (chromium package)
Discovery Timeline
- 2024-02-07 - CVE-2024-1284 published to the National Vulnerability Database
- 2025-05-15 - Last updated in NVD database
Technical Details for CVE-2024-1284
Vulnerability Analysis
The vulnerability resides in Mojo, the IPC subsystem Chromium uses to broker communication between the browser, renderer, GPU, and utility processes. A use-after-free condition occurs when a Mojo object is freed while a reference to it remains reachable. Subsequent operations against the dangling pointer corrupt heap metadata or invoke attacker-controlled function pointers.
Exploitation is network-reachable and requires no privileges or user interaction beyond visiting a page. Because Mojo handles privileged inter-process messages, a successful exploit in the renderer can be paired with a sandbox escape to break out of the renderer boundary. The remote attack surface and absence of authentication requirements explain the network-based exposure profile.
Root Cause
The root cause is improper lifetime management of an object handled by Mojo IPC pipes. When the object is released, residual references continue to dereference the freed memory region. Allocator behavior allows an attacker to reclaim the freed slot with controlled data, transforming the dangling reference into an arbitrary read, write, or control-flow primitive.
Attack Vector
An attacker hosts a malicious HTML page that issues a crafted sequence of JavaScript and Mojo-bound operations. Visiting the page from a vulnerable Chrome build causes the affected Mojo object to be freed and subsequently reused, triggering heap corruption inside the renderer process. Refer to the Chromium Issue Tracker entry 41494539 and the Google Chrome Desktop Update advisory for vendor details.
Detection Methods for CVE-2024-1284
Indicators of Compromise
- Chrome renderer process crashes with heap corruption signatures, SIGSEGV, or STATUS_HEAP_CORRUPTION faults shortly after navigation to an untrusted page.
- Unexpected child processes spawned by chrome.exe or chrome immediately following a crash event.
- Outbound network connections from Chrome renderer processes to uncategorized or newly registered domains.
Detection Strategies
- Inventory installed Chrome builds across the fleet and flag any version below 121.0.6167.160 as vulnerable.
- Correlate browser crash telemetry with web proxy logs to identify pages that consistently precede renderer faults.
- Monitor for anomalous post-exploitation behavior such as Chrome processes writing to autorun locations, loading unsigned modules, or invoking cmd.exe, powershell.exe, or shell binaries.
Monitoring Recommendations
- Centralize browser version telemetry and crash dumps in a SIEM or data lake for longitudinal analysis.
- Alert on chrome.exe child processes outside the expected Chrome process tree (crashpad_handler, chrome_proxy).
- Track DNS and TLS metadata for connections initiated by renderer processes to detect drive-by exploitation infrastructure.
How to Mitigate CVE-2024-1284
Immediate Actions Required
- Update Google Chrome to version 121.0.6167.160 or later on all managed endpoints.
- Apply the corresponding Fedora chromium package updates published in the Fedora announcement KN32XXNHIR6KBS4BYQTZV2JQFN4D6ZSE and WSCIL2WH2L4R4KWSRCTDWBPAMOJIYBJE.
- Force-restart Chrome after update to ensure the patched binary is loaded.
Patch Information
Google resolved CVE-2024-1284 in the Stable channel release 121.0.6167.160 for desktop. Details are documented in the Stable Channel Update for Desktop. Fedora 38 and Fedora 39 published rebased chromium packages through package-announce notifications.
Workarounds
- Enforce automatic Chrome updates through enterprise policy (UpdateDefault and AutoUpdateCheckPeriodMinutes) until all endpoints report a patched version.
- Restrict browsing from privileged or jump hosts to a curated allowlist while patch deployment is in progress.
- Deploy site isolation and strict third-party cookie policies to reduce the exploitable attack surface in shared browsing contexts.
# Verify the installed Chrome version on Linux endpoints
google-chrome --version
# Update Fedora chromium packages
sudo dnf upgrade --refresh chromium
# Windows: query installed Chrome version via registry
reg query "HKLM\SOFTWARE\Google\Chrome\BLBeacon" /v version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
