CVE-2024-3169: Google Chrome V8 Use-After-Free Flaw

CVE-2024-3169 Overview

CVE-2024-3169 is a use-after-free vulnerability in the V8 JavaScript engine of Google Chrome. The flaw affects versions prior to 121.0.6167.139 and allows a remote attacker to potentially exploit heap corruption through a crafted HTML page. The Chromium project rated the security severity as High, and the NVD assigned a CVSS 3.1 base score of 8.8. The weakness is classified under CWE-416: Use After Free. Successful exploitation requires user interaction, typically visiting a malicious or compromised web page.

Critical Impact
A crafted HTML page can trigger heap corruption in V8, enabling remote code execution within the Chrome renderer process.

Affected Products

Google Chrome versions prior to 121.0.6167.139
Chromium-based browsers using the same V8 engine build
Desktop platforms shipping the Stable channel before the January 30, 2024 update

Discovery Timeline

2024-07-16 - CVE-2024-3169 published to NVD
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-3169

Vulnerability Analysis

The vulnerability resides in V8, the JavaScript and WebAssembly engine that powers Chrome. A use-after-free condition occurs when memory is referenced after it has been freed, allowing an attacker to influence the contents of the reclaimed allocation. In V8, such flaws frequently stem from incorrect lifetime tracking of objects across garbage collection or optimization passes. An attacker who controls the freed memory can corrupt heap metadata, hijack object pointers, or pivot to arbitrary read/write primitives inside the renderer sandbox.

Root Cause

The root cause is improper memory management within V8 [CWE-416]. A reference to a heap object remains live after the object is freed, and subsequent use of that dangling pointer leads to memory corruption. Chromium developers addressed the issue in build 121.0.6167.139. Specific patch details are tracked in the Chromium Issue Tracker Entry.

Attack Vector

Exploitation occurs over the network and requires the victim to load attacker-controlled content. The adversary hosts a crafted HTML page that delivers JavaScript designed to trigger the use-after-free in V8. No privileges are required, but user interaction is necessary because the victim must visit the page. Heap corruption inside the renderer can be chained with a sandbox escape to achieve full code execution on the host. See the Google Chrome Update Announcement for vendor-published context.

Detection Methods for CVE-2024-3169

Indicators of Compromise

Chrome renderer processes (chrome.exe --type=renderer) crashing with access violations after visiting untrusted pages
Browser telemetry showing version strings older than 121.0.6167.139 on managed endpoints
Outbound connections from chrome.exe to suspicious domains followed by spawn of unexpected child processes

Detection Strategies

Inventory installed Chrome versions across the fleet and flag any build below 121.0.6167.139
Monitor for anomalous child processes created by chrome.exe, which may indicate a successful renderer compromise and sandbox escape
Correlate Chrome crash dumps with proxy logs to identify users who loaded weaponized HTML before the crash

Monitoring Recommendations

Centralize browser version telemetry via enterprise policy and review weekly until full patch coverage is confirmed
Forward Chrome crash and stability events into a SIEM or data lake for correlation with web proxy and EDR data
Subscribe to the Chrome Releases blog and Chromium issue tracker for follow-on advisories affecting V8

How to Mitigate CVE-2024-3169

Immediate Actions Required

Update Google Chrome to version 121.0.6167.139 or later on all Windows, macOS, and Linux endpoints
Restart browsers after deployment so the patched binary is actually loaded into memory
Audit Chromium-based browsers and embedded WebView components for the same vulnerable V8 build and patch accordingly

Patch Information

Google addressed the issue in the Stable channel update released on January 30, 2024, shipping Chrome 121.0.6167.139 for desktop. Administrators should verify deployment using enterprise update servers and the Google Chrome Update Announcement.

Workarounds

Restrict browsing to trusted sites using web filtering or proxy allowlists until the patch is deployed
Disable or limit JavaScript execution on untrusted origins via enterprise policy where business processes allow
Apply site isolation and the strictest available sandbox flags to reduce the impact of a renderer compromise

bash

# Verify the installed Chrome version on Linux endpoints
google-chrome --version

# Windows: check via registry (PowerShell)
Get-ItemProperty 'HKLM:\SOFTWARE\Google\Update\Clients\*' |
  Where-Object { $_.name -match 'Chrome' } |
  Select-Object name, pv