CVE-2024-5841: Google Chrome Use-After-Free Vulnerability

CVE-2024-5841 Overview

CVE-2024-5841 is a use-after-free vulnerability in the V8 JavaScript engine used by Google Chrome versions prior to 126.0.6478.54. A remote attacker can trigger heap corruption by enticing a user to visit a crafted HTML page. Successful exploitation can lead to arbitrary code execution within the renderer process, with potential for sandbox escape when chained with additional flaws. The issue is tracked under [CWE-416] (Use After Free) and affects Google Chrome on all supported desktop platforms, as well as Fedora 39 and Fedora 40 distributions that ship Chromium-based packages.

Critical Impact
Remote attackers can corrupt heap memory in the V8 engine through a malicious web page, enabling potential arbitrary code execution in the browser renderer process.

Affected Products

Google Chrome versions prior to 126.0.6478.54
Fedora 39
Fedora 40

Discovery Timeline

2024-06-11 - CVE-2024-5841 published to the National Vulnerability Database (NVD)
2024-11-21 - Last updated in the NVD database

Technical Details for CVE-2024-5841

Vulnerability Analysis

The flaw resides in V8, the JavaScript and WebAssembly engine that powers Chrome's rendering of dynamic web content. A use-after-free condition occurs when the engine continues to reference a memory object after it has been freed. Attackers leverage this dangling pointer to corrupt heap structures and influence control flow.

Exploitation requires user interaction in the form of visiting a malicious page. Once triggered, the corrupted heap state can be groomed to overlap controlled data with engine internals, enabling type confusion or pointer overwrites. This class of bug is commonly used by attackers to gain initial code execution inside the renderer, which is then chained with sandbox escapes for full system compromise.

Root Cause

The root cause is improper object lifetime management within V8. An object is deallocated while a reference to it remains reachable from JavaScript-accessible structures. Subsequent access through the stale reference reads or writes freed memory, producing the heap corruption primitive required for exploitation.

Attack Vector

The attack vector is network-based and exploited through the browser. An attacker hosts a crafted HTML page containing JavaScript that manipulates V8 objects to reach the vulnerable code path. User interaction is required, typically clicking a link or loading an attacker-controlled site. Drive-by download scenarios, malvertising, and compromised legitimate sites are all viable delivery channels.

No public proof-of-concept exploit code is available for this CVE, and it is not listed in the CISA Known Exploited Vulnerabilities catalog. See the Chromium Issue Tracker Entry and the Google Chrome Stable Update for vendor-supplied technical references.

Detection Methods for CVE-2024-5841

Indicators of Compromise

Chrome renderer process crashes with signatures pointing to V8 heap corruption in versions prior to 126.0.6478.54.
Outbound connections from browser processes to newly observed or low-reputation domains shortly after page navigation.
Unexpected child processes spawned from chrome.exe or the Chrome renderer on endpoints.

Detection Strategies

Inventory installed Chrome versions across the fleet and flag any host running a build earlier than 126.0.6478.54.
Monitor endpoint telemetry for renderer process crashes followed by suspicious process creation or persistence activity.
Inspect web proxy and DNS logs for users browsing to URLs delivering heavily obfuscated JavaScript targeting V8 internals.

Monitoring Recommendations

Enable browser crash reporting and forward Chrome crash dumps to a central SIEM for correlation.
Alert on Chrome processes writing to autorun locations, scheduled tasks, or executable directories.
Track Fedora package update status on Linux endpoints to confirm timely deployment of Chromium fixes.

How to Mitigate CVE-2024-5841

Immediate Actions Required

Update Google Chrome to version 126.0.6478.54 or later on all Windows, macOS, and Linux endpoints.
Apply Fedora package updates referenced in the Fedora 39 advisory and Fedora 40 advisory.
Restart browser instances after patching to ensure the vulnerable renderer code is unloaded from memory.

Patch Information

Google released the fix in the Chrome Stable channel update 126.0.6478.54/55 for desktop platforms. Details are available in the Google Chrome Stable Update announcement. Fedora published corresponding Chromium package updates for Fedora 39 and Fedora 40.

Workarounds

Deploy enterprise policy to enforce automatic Chrome updates and prevent users from disabling background updates.
Restrict access to high-risk web categories through enterprise web filtering until patches are confirmed installed.
Consider disabling JavaScript on untrusted sites via site settings policies as a temporary control on unpatched hosts.

bash

# Verify installed Chrome version on Linux endpoints
google-chrome --version

# Update Chromium on Fedora
sudo dnf upgrade --refresh chromium