CVE-2024-4558: Google Chrome Use After Free Vulnerability

CVE-2024-4558 Overview

CVE-2024-4558 is a use-after-free vulnerability in the ANGLE (Almost Native Graphics Layer Engine) component of Google Chrome prior to version 124.0.6367.155. ANGLE is a critical graphics abstraction layer that translates OpenGL ES API calls to platform-specific graphics APIs like DirectX on Windows, OpenGL on desktop platforms, and Metal on macOS. This memory corruption vulnerability allows a remote attacker to potentially exploit heap corruption by convincing a victim to visit a specially crafted HTML page.

Critical Impact

This vulnerability enables remote attackers to potentially achieve arbitrary code execution through heap corruption when victims visit malicious web pages, affecting multiple browsers and operating systems that utilize the ANGLE graphics library.

Affected Products

• Google Chrome (prior to version 124.0.6367.155)
• Apple Safari
• Apple macOS
• Apple iOS (iPhone OS)
• Apple iPadOS
• Fedora Project Fedora (versions 38, 39, 40)

Discovery Timeline

• May 7, 2024 - CVE-2024-4558 published to NVD
• November 4, 2025 - Last updated in NVD database

Technical Details for CVE-2024-4558

Vulnerability Analysis

This vulnerability is classified as CWE-416 (Use After Free), a dangerous memory corruption issue where a program continues to reference memory after it has been freed. In the context of ANGLE, this occurs within the graphics rendering pipeline, where complex object lifecycle management during WebGL or other GPU-accelerated operations can lead to dangling pointer conditions.

The ANGLE library serves as a critical bridge between web content rendering and hardware-accelerated graphics. When processing specially crafted WebGL content or canvas operations embedded in HTML pages, improper memory management can result in a condition where freed memory is subsequently accessed. This creates an exploitable primitive where an attacker can potentially control the contents of the freed memory region, leading to heap corruption.

The network-based attack vector requires user interaction—specifically, a victim must navigate to a malicious page or be redirected through compromised advertisements or links. The scope is changed, meaning successful exploitation can impact resources beyond the vulnerable component's security authority, potentially escaping browser sandbox protections.

Root Cause

The root cause stems from improper object lifecycle management within ANGLE's graphics processing code. When rendering complex graphical content, ANGLE must allocate and deallocate numerous graphics objects and buffers. A race condition or logic error in the object destruction sequence can result in a pointer remaining valid after its referenced memory has been freed. Subsequent operations that reference this dangling pointer trigger the use-after-free condition, corrupting heap metadata or application data structures.

Attack Vector

The attack leverages the network vector, requiring an attacker to host or inject malicious content that triggers the vulnerable code path when rendered by affected browsers. The exploitation flow involves:

1. Attacker crafts a malicious HTML page containing WebGL or canvas elements designed to trigger specific ANGLE code paths
2. Victim navigates to the attacker-controlled page or encounters the malicious content through advertising networks or compromised legitimate sites
3. The browser's rendering engine processes the malicious graphical content through ANGLE
4. Memory corruption occurs during graphics object lifecycle operations
5. Attacker-controlled data occupies the freed memory region, enabling potential code execution

The vulnerability mechanism centers on the timing and sequence of graphics object operations within ANGLE. By carefully constructing WebGL shaders, buffer operations, or texture manipulations, an attacker can trigger the memory management flaw. Technical details and patches are available in the Chromium Issue Tracker #337766133 and the Google Chrome Stable Update announcement.

Detection Methods for CVE-2024-4558

Indicators of Compromise

• Unusual browser crashes or hangs when visiting unfamiliar websites, particularly those with heavy WebGL or canvas usage
• Memory access violations or heap corruption errors in browser crash reports referencing ANGLE or graphics-related components
• Detection of exploit delivery pages containing obfuscated JavaScript with WebGL shader manipulation
• Anomalous network traffic patterns to domains hosting known exploit kits targeting browser vulnerabilities

Detection Strategies

• Deploy browser version monitoring to identify installations running Chrome versions prior to 124.0.6367.155 or unpatched Safari/macOS/iOS versions
• Implement endpoint detection rules to identify suspicious WebGL API call sequences that may indicate exploitation attempts
• Monitor for crash patterns in libGLESv2.dll, libANGLE.dylib, or equivalent ANGLE library components
• Utilize web proxy inspection to detect pages containing potential exploit payloads targeting graphics rendering vulnerabilities

Monitoring Recommendations

• Enable browser telemetry and crash reporting to centralized security monitoring platforms
• Configure SentinelOne agents to monitor browser process behavior for signs of heap corruption exploitation
• Implement network-level inspection for known malicious domains associated with browser exploit delivery
• Review endpoint logs for repeated browser restarts or crashes that may indicate exploitation attempts

How to Mitigate CVE-2024-4558

Immediate Actions Required

• Update Google Chrome to version 124.0.6367.155 or later immediately across all enterprise endpoints
• Apply the latest security updates for Apple Safari, macOS, iOS, and iPadOS as documented in Apple Support Document #HT214117, #HT214119, and #HT214121
• Update Fedora systems through the package manager to receive patched Chromium packages as announced in the Fedora Package Announcements
• Prioritize patching for systems with internet-facing browser usage and those handling sensitive data

Patch Information

Google addressed this vulnerability in Chrome version 124.0.6367.155 released on May 7, 2024. The fix was subsequently adopted by other browsers and operating systems that utilize the ANGLE library. Detailed patch information is available in the Google Chrome Stable Channel Update announcement. Apple released corresponding fixes documented in their security knowledge base articles. Debian LTS users should reference the Debian LTS Security Announcement for backported patches.

Workarounds

• Temporarily disable WebGL in browser settings if immediate patching is not feasible: navigate to chrome://flags/#disable-webgl and enable the flag
• Implement web filtering to block access to untrusted sites until patches can be deployed
• Consider using application sandboxing or virtualization for high-risk browsing activities
• Deploy browser isolation solutions to contain potential exploitation attempts

# Verify Chrome version meets minimum patch level
# On Linux/macOS
google-chrome --version | grep -E "124\.0\.6367\.(15[5-9]|1[6-9][0-9]|[2-9][0-9]{2})" || echo "UPDATE REQUIRED"

# Enterprise deployment - force Chrome update via policy
# Windows Group Policy: Set "Update policy override" to "Always allow updates"
# Or use Chrome Browser Cloud Management for centralized update control