CVE-2024-3170 Overview
CVE-2024-3170 is a use-after-free vulnerability in the WebRTC component of Google Chrome versions prior to 121.0.6167.85. A remote attacker can exploit heap corruption by serving a crafted HTML page to a targeted user. The flaw is classified under [CWE-416] and affects Chrome's real-time communication stack used for audio, video, and peer-to-peer data channels. Google addressed the issue in the stable channel update released in January 2024.
Critical Impact
A successful exploit can corrupt heap memory and lead to arbitrary code execution within the Chrome renderer process when a user visits an attacker-controlled web page.
Affected Products
- Google Chrome on Windows prior to 121.0.6167.85
- Google Chrome on macOS prior to 121.0.6167.85
- Google Chrome on Linux prior to 121.0.6167.85
Discovery Timeline
- 2024-07-16 - CVE-2024-3170 published to NVD
- 2024-11-21 - Last updated in NVD database
For vendor details, see the Google Chrome Stable Update and the Chromium Issue Tracker Entry.
Technical Details for CVE-2024-3170
Vulnerability Analysis
The vulnerability resides in Chrome's WebRTC implementation, which handles real-time peer-to-peer media and data exchange in the browser. WebRTC objects span multiple subsystems including signaling, media tracks, and data channels, increasing the surface for lifetime management errors. A use-after-free occurs when code continues to operate on a heap object that has already been freed. Attackers leverage this condition to control freed memory contents and redirect execution flow inside the renderer process.
Exploitation typically chains the heap corruption with a sandbox escape to achieve full code execution outside the renderer. The renderer-level impact alone enables credential theft, cross-origin data access, and persistent malicious script execution against targeted users.
Root Cause
The defect is a [CWE-416] use-after-free condition in WebRTC code paths reachable from JavaScript APIs. Object lifetime management between asynchronous callbacks and main-thread teardown allows a dangling pointer to remain reachable. When the freed allocation is later reused, attacker-controlled data can occupy the original slot.
Attack Vector
The attack vector is network-based and requires user interaction. A victim must visit a crafted HTML page that invokes WebRTC APIs in a specific sequence to trigger the freed-object reuse. No authentication is required, and the page can be hosted on any web server or delivered through malvertising, phishing links, or compromised sites.
// No verified proof-of-concept code is published for CVE-2024-3170.
// Refer to the Chromium issue tracker entry 41488824 for technical context.
Detection Methods for CVE-2024-3170
Indicators of Compromise
- Chrome renderer process crashes with heap corruption signatures referencing WebRTC modules such as libwebrtc frames.
- Unexpected child processes spawned by chrome.exe shortly after navigation to an untrusted URL.
- Outbound connections from a Chrome renderer to unfamiliar STUN, TURN, or signaling endpoints not associated with legitimate applications.
Detection Strategies
- Inventory Chrome installations and flag any version below 121.0.6167.85 across managed endpoints.
- Monitor endpoint telemetry for renderer crashes followed by anomalous process creation or memory allocation patterns.
- Apply behavioral analytics to identify post-exploitation activity such as credential access, token theft, or unsigned binary execution originating from the browser.
Monitoring Recommendations
- Forward Chrome crash reports and EDR process events into a centralized data lake for correlation with web traffic logs.
- Alert on Chrome processes writing executables to user-writable paths or loading unsigned modules.
- Track navigation to newly registered or low-reputation domains immediately preceding renderer instability.
How to Mitigate CVE-2024-3170
Immediate Actions Required
- Update Google Chrome to version 121.0.6167.85 or later on all managed endpoints.
- Force-restart Chrome after deployment so the patched binaries replace running processes.
- Audit Chromium-based browsers and Electron applications that embed older WebRTC builds and update them to fixed releases.
Patch Information
Google released the fix in the stable channel update for desktop on January 23, 2024. Administrators should validate the deployed build through chrome://settings/help and confirm it reports 121.0.6167.85 or higher. Details are provided in the Google Chrome Stable Update.
Workarounds
- Restrict WebRTC functionality through enterprise policy where business workflows do not require it, using settings such as WebRtcUdpPortRange and WebRtcLocalIpsAllowedUrls.
- Enforce site isolation and Safe Browsing Enhanced Protection through Chrome enterprise policies.
- Apply browser hardening via group policy until patching is confirmed across the fleet.
# Verify Chrome version on Linux endpoints
google-chrome --version
# Windows: query installed Chrome version
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
