CVE-2024-5497: Google Chrome Browser UI RCE Vulnerability

CVE-2024-5497 Overview

CVE-2024-5497 is an out-of-bounds memory access vulnerability in the Browser UI component of Google Chrome versions prior to 125.0.6422.141. A remote attacker can exploit this flaw by serving a crafted HTML page and convincing the user to perform specific UI gestures. Successful exploitation can trigger heap corruption inside the browser process, which runs at higher privilege than sandboxed renderers. Chromium rates the security severity as High. The flaw maps to CWE-787 Out-of-Bounds Write and CWE-125 Out-of-Bounds Read.

Critical Impact
Heap corruption in the Chrome browser process can lead to arbitrary code execution outside the renderer sandbox, compromising confidentiality, integrity, and availability of the host.

Affected Products

Google Chrome versions prior to 125.0.6422.141
Fedora 39 (Chromium package)
Fedora 40 (Chromium package)

Discovery Timeline

2024-05-30 - CVE-2024-5497 published to NVD following the Chrome Stable Channel update
2024-12-26 - Last updated in NVD database

Technical Details for CVE-2024-5497

Vulnerability Analysis

The vulnerability resides in the Browser UI layer of Chrome, the privileged process responsible for rendering UI chrome, menus, and dialogs outside the renderer sandbox. An out-of-bounds memory access occurs when handling specific user interface gestures driven by attacker-controlled content. Because the Browser UI process is not confined by the renderer sandbox, memory corruption here is materially more dangerous than equivalent bugs in renderer code.

Exploitation requires user interaction. The attacker delivers a crafted HTML page that influences UI state, then convinces the user to perform specific actions such as drag, hover, or context-menu gestures. These gestures trigger the out-of-bounds read or write, leading to heap corruption.

The vulnerability has an EPSS exploitation probability of 0.719%, placing it in the 72nd percentile of CVEs, indicating moderate likelihood of weaponization compared to the broader CVE population.

Root Cause

The defect stems from improper bounds checking in Browser UI code paths invoked by user gestures. Memory accesses indexed by attacker-influenced values exceed the bounds of the underlying buffer or container, producing heap-based read or write primitives. The fix is tracked in Chromium Issue #339061099.

Attack Vector

The attack vector is network-based with required user interaction. An attacker hosts or injects a crafted HTML page, lures the victim to visit it, and instructs or tricks the user into a specific UI gesture sequence. No authentication is required. A successful exploit chained with a separate sandbox escape or executed directly against the Browser UI process can yield code execution at the privilege level of the Chrome browser process.

No public proof-of-concept code or in-the-wild exploitation has been reported for this CVE.

Detection Methods for CVE-2024-5497

Indicators of Compromise

Chrome browser process crashes referencing heap corruption, __asan reports, or access-violation faults originating in Browser UI modules on hosts running Chrome versions earlier than 125.0.6422.141.
Unexpected child processes spawned by chrome.exe immediately following user interaction with a recently loaded web page.
Outbound network connections from the Chrome browser process to non-browsing destinations following a crash or restart event.

Detection Strategies

Inventory installed Chrome and Chromium builds across the fleet and flag any version below 125.0.6422.141 as exposed.
Hunt for Chrome crash telemetry and Windows Error Reporting events correlated with visits to untrusted domains.
Monitor for post-exploitation behaviors common after browser compromise: credential file access, token theft, and lateral movement attempts from user workstations.

Monitoring Recommendations

Forward browser process telemetry and EDR detections into a central data lake for cross-host correlation of crash patterns.
Track Chrome auto-update status to confirm endpoints have applied the 125.0.6422.141 or later build.
Alert on Chrome processes loading unexpected DLLs or executing child processes such as cmd.exe, powershell.exe, or rundll32.exe.

How to Mitigate CVE-2024-5497

Immediate Actions Required

Update Google Chrome to version 125.0.6422.141 or later on Windows, macOS, and Linux endpoints.
Update Chromium packages on Fedora 39 and Fedora 40 using dnf update chromium to pull the patched builds announced by the Fedora project.
Restart all Chrome instances after update to ensure the patched binary is loaded into memory.
Verify the active version through chrome://settings/help or centralized management tooling.

Patch Information

Google addressed CVE-2024-5497 in the Chrome Stable Channel update 125.0.6422.141, documented in the Google Chrome Desktop Update advisory. Fedora shipped corresponding Chromium updates documented in the Fedora 39 Package Announcement and Fedora 40 Package Announcement.

Workarounds

No official workaround exists. Patching is the only supported remediation.
Enforce Chrome auto-update via enterprise policy to reduce dwell time on vulnerable builds.
Restrict navigation to untrusted sites using web filtering and DNS controls until patching completes.
Educate users to avoid performing UI gestures requested by untrusted web pages.

bash

# Verify and update Chromium on Fedora
rpm -q chromium
sudo dnf upgrade --refresh chromium

# Verify Chrome version on Linux
google-chrome --version  # Must be >= 125.0.6422.141