CVE-2024-4058: Google Chrome ANGLE RCE Vulnerability

CVE-2024-4058 Overview

CVE-2024-4058 is a type confusion vulnerability in ANGLE (Almost Native Graphics Layer Engine) in Google Chrome prior to version 124.0.6367.78. ANGLE is a critical graphics abstraction layer that translates OpenGL ES API calls to hardware-supported APIs like DirectX, Vulkan, or Metal. This vulnerability allows a remote attacker to potentially exploit heap corruption via a crafted HTML page, potentially leading to arbitrary code execution within the browser's sandbox or escaping it entirely.

Critical Impact

Remote attackers can exploit this type confusion vulnerability through a maliciously crafted HTML page, potentially achieving code execution through heap corruption in the browser's graphics rendering pipeline.

Affected Products

• Google Chrome versions prior to 124.0.6367.78
• Fedora 40 (packages using Chromium)
• Chromium-based browsers sharing the vulnerable ANGLE component

Discovery Timeline

• April 24, 2024 - Google releases security patch in Chrome 124.0.6367.78
• May 1, 2024 - CVE-2024-4058 published to NVD
• November 4, 2025 - Last updated in NVD database

Technical Details for CVE-2024-4058

Vulnerability Analysis

This vulnerability is classified as CWE-843: Access of Resource Using Incompatible Type ('Type Confusion'). Type confusion occurs when a program accesses a resource using an incompatible type, leading to undefined behavior that attackers can exploit. In the context of ANGLE, the type confusion manifests in how the graphics layer handles certain object types during WebGL or OpenGL ES operations.

When exploited, the type confusion causes the browser to misinterpret memory contents, treating data of one type as another. This misinterpretation leads to heap corruption, where memory structures are modified in unintended ways. Attackers can leverage this corruption to achieve arbitrary read/write primitives, ultimately gaining code execution capabilities within the renderer process.

Root Cause

The root cause lies in ANGLE's improper type handling within its graphics translation layer. ANGLE converts OpenGL ES calls to platform-native graphics APIs, and during this translation process, certain objects were not properly validated for their expected types. When a specially crafted WebGL context or shader manipulates these objects, the type confusion condition is triggered, causing the graphics backend to operate on memory with incorrect type assumptions.

Attack Vector

The attack is network-based and requires user interaction—specifically, the victim must navigate to a malicious webpage. The attacker hosts a crafted HTML page containing malicious WebGL content or JavaScript that triggers the type confusion in ANGLE. When the victim's browser renders this page:

1. The malicious WebGL/canvas content initiates graphics operations through ANGLE
2. Specially crafted shader code or buffer operations trigger the type confusion
3. The type confusion leads to heap corruption in the renderer process
4. The attacker can potentially achieve arbitrary code execution

The attack can be delivered through various vectors including malicious advertisements, compromised websites, or phishing campaigns directing users to attacker-controlled pages.

Detection Methods for CVE-2024-4058

Indicators of Compromise

• Unusual browser crashes specifically related to GPU processes or WebGL rendering
• Suspicious network connections to unknown domains serving JavaScript or WebGL content
• Chrome crash reports indicating ANGLE-related memory corruption
• Anomalous GPU process memory usage patterns prior to browser instability

Detection Strategies

• Monitor for Chrome crash reports with signatures related to ANGLE or GPU process failures
• Implement network-based detection for known malicious domains distributing exploit code
• Deploy endpoint detection solutions capable of identifying heap corruption exploitation patterns
• Enable Chrome's enhanced safe browsing to detect malicious pages before rendering

Monitoring Recommendations

• Review browser update status across enterprise environments to identify unpatched Chrome installations
• Monitor Chrome enterprise logs for repeated renderer or GPU process crashes
• Implement web proxy logging to track access to suspicious JavaScript-heavy pages
• Configure SIEM rules to correlate browser crashes with network activity to potentially malicious sites

How to Mitigate CVE-2024-4058

Immediate Actions Required

• Update Google Chrome to version 124.0.6367.78 or later immediately
• Enable automatic updates for Chrome across all enterprise endpoints
• For Fedora 40 systems, apply the latest Chromium package updates from official repositories
• Consider temporarily disabling WebGL in high-security environments until patching is complete

Patch Information

Google addressed this vulnerability in the Chrome 124.0.6367.78 stable channel release on April 24, 2024. The fix corrects the type handling in ANGLE to properly validate object types during graphics operations. Organizations should reference the Google Chrome Release Update for official patch details.

Fedora users should apply updates as announced in the Fedora Package Announcement for Fedora 40.

Additional technical details can be found in the Chromium Issue Tracker Entry.

Workarounds

• Disable WebGL by navigating to chrome://flags/#disable-webgl and enabling the flag (temporary mitigation)
• Use browser isolation solutions for high-risk browsing activities
• Implement content security policies that restrict WebGL usage on trusted sites only
• Consider using alternative browsers temporarily in high-security environments until Chrome is updated

# Verify Chrome version on Linux/macOS
google-chrome --version
# Expected output should be 124.0.6367.78 or higher

# For enterprise deployments, check Chrome policies
cat /etc/opt/chrome/policies/managed/*.json | grep -i "BrowserVersion"

# Fedora update command
sudo dnf update chromium --refresh