CVE-2024-4558: Google Chrome Use After Free Vulnerability

CVE-2024-4558 Overview

CVE-2024-4558 is a use-after-free vulnerability in ANGLE, the graphics abstraction layer used by Google Chrome to translate OpenGL ES calls to native graphics APIs. The flaw affects Google Chrome versions prior to 124.0.6367.155 and allows a remote attacker to exploit heap corruption through a crafted HTML page. Because ANGLE is shared across multiple downstream projects, the issue extends beyond Chrome to Apple Safari, iOS, iPadOS, macOS, and Fedora Linux distributions. The vulnerability requires user interaction, typically by visiting a malicious page, and can result in arbitrary code execution within the renderer process.

Critical Impact
A remote attacker can trigger heap corruption in the renderer process via a crafted HTML page, potentially leading to arbitrary code execution and sandbox escape chaining.

Affected Products

Google Chrome prior to 124.0.6367.155
Apple Safari, iOS, iPadOS, and macOS (shipping affected ANGLE/WebKit components)
Fedora 38, 39, and 40, plus Debian LTS Chromium packages

Discovery Timeline

2024-05-07 - CVE-2024-4558 published to the National Vulnerability Database
2024-05-07 - Google releases Chrome Stable Channel update 124.0.6367.155 addressing the vulnerability
2025-11-04 - Last updated in NVD database

Technical Details for CVE-2024-4558

Vulnerability Analysis

The vulnerability is a use-after-free condition [CWE-416] in ANGLE (Almost Native Graphics Layer Engine). ANGLE translates WebGL and OpenGL ES API calls into hardware-accelerated calls for Direct3D, Metal, Vulkan, or desktop OpenGL. A use-after-free occurs when memory referenced by a pointer is freed but the pointer is subsequently dereferenced. An attacker who controls the contents of the reclaimed heap region can manipulate program state, corrupt object vtables, or hijack control flow.

In the context of Chrome's renderer process, exploitation of an ANGLE flaw typically begins with a crafted page that issues a specific sequence of WebGL calls. The attack achieves heap corruption that can be shaped into arbitrary read, write, or code execution primitives within the renderer sandbox.

Root Cause

The root cause is improper lifetime management of a graphics object inside ANGLE. A reference to a freed allocation remains accessible to subsequent WebGL operations, allowing reuse of the dangling memory. Details are tracked in Chromium Issue #337766133.

Attack Vector

Exploitation occurs over the network and requires user interaction. The victim must load attacker-controlled HTML, typically containing JavaScript that invokes WebGL APIs in a sequence that triggers the freed-object reuse. The scope is changed because successful exploitation in the renderer can be paired with a sandbox escape to compromise the host. No authentication is required.

No verified public proof-of-concept code is available. See the Google Chrome Stable Update for vendor information.

Detection Methods for CVE-2024-4558

Indicators of Compromise

Chrome, Chromium, or WebKit-based browser processes crashing with heap corruption signatures shortly after rendering external web content
Renderer process spawning unexpected child processes or attempting outbound connections to unfamiliar hosts
Browser telemetry showing client versions older than Chrome 124.0.6367.155 actively in use

Detection Strategies

Inventory installed browser versions across managed endpoints and flag any Chrome, Chromium, Safari, or Fedora Chromium build below the patched release
Monitor renderer process crash dumps and Windows Error Reporting events that reference libGLESv2, libEGL, or ANGLE modules
Inspect web proxy logs for repeated visits to low-reputation domains immediately preceding browser crashes

Monitoring Recommendations

Forward browser crash telemetry and EDR process events to a centralized analytics platform for correlation
Alert on unsigned or unexpected modules loaded into browser processes following crashes
Track patch compliance metrics for Chrome, Safari, and Linux distribution packages against the fixed versions

How to Mitigate CVE-2024-4558

Immediate Actions Required

Update Google Chrome to version 124.0.6367.155 or later on all Windows, macOS, and Linux endpoints
Apply Apple security updates referenced in HT214117, HT214119, and HT214121 for Safari, macOS, iOS, and iPadOS
Update Fedora and Debian Chromium packages per the Debian LTS announcement and Fedora package announcements

Patch Information

Google released Chrome Stable Channel 124.0.6367.155 on May 7, 2024, addressing CVE-2024-4558. Downstream maintainers, including Fedora and Debian, shipped corresponding Chromium package updates. Apple delivered fixes through Safari, macOS, iOS, and iPadOS security releases. Administrators should confirm browser auto-update is enabled and validate version compliance after deployment.

Workarounds

Disable WebGL in managed browser policies where feasible, recognizing this breaks some web applications
Restrict browsing on sensitive systems to allowlisted domains through web proxy or DNS filtering
Enforce site isolation and strict sandbox policies via enterprise browser configuration

bash

# Verify Chrome version on Linux
google-chrome --version

# Force Chrome policy update on Windows (PowerShell, elevated)
gpupdate /force

# Disable WebGL via Chrome enterprise policy (registry, Windows)
reg add "HKLM\SOFTWARE\Policies\Google\Chrome" /v WebGLEnabled /t REG_DWORD /d 0 /f