CVE-2024-5842: Google Chrome Use After Free Vulnerability

CVE-2024-5842 Overview

CVE-2024-5842 is a use-after-free vulnerability in the Browser UI component of Google Chrome before version 126.0.6478.54. A remote attacker can exploit this flaw by convincing a user to perform specific UI gestures on a crafted HTML page, triggering an out-of-bounds memory read. The vulnerability is tracked under [CWE-416] (Use After Free) and affects Chrome on multiple platforms, including Fedora 39 and Fedora 40 distributions. Successful exploitation can compromise the confidentiality, integrity, and availability of the affected browser process. Google addressed the issue in the Stable channel desktop update released in June 2024.

Critical Impact
Remote attackers can trigger memory corruption in the Chrome Browser UI process through crafted HTML pages combined with user interaction, enabling out-of-bounds memory reads with high impact to confidentiality, integrity, and availability.

Affected Products

Google Chrome prior to 126.0.6478.54
Fedora 39
Fedora 40

Discovery Timeline

2024-06-11 - CVE-2024-5842 published to NVD
2024-06 - Google releases security patch in Chrome Stable channel
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-5842

Vulnerability Analysis

The flaw is a use-after-free condition within Chrome's Browser UI component. Use-after-free vulnerabilities occur when a program continues to reference memory after it has been freed, allowing attackers to manipulate the contents of that memory region. In this case, the dangling reference enables an out-of-bounds memory read within the browser process. Because the Browser UI runs at a higher privilege level than sandboxed renderer processes, leaked memory contents may expose sensitive process state or aid in further exploit chains.

Root Cause

The root cause is improper lifetime management of an object referenced by the Browser UI code path. When a specific sequence of UI interactions occurs, the underlying object is released while a stale pointer is still dereferenced during rendering or event handling. The dereference reads from memory that may have been reallocated, producing the out-of-bounds read primitive associated with [CWE-416].

Attack Vector

Exploitation requires network delivery of attacker-controlled content and user interaction. The attacker hosts a crafted HTML page and convinces the victim to visit it and perform specific UI gestures, such as clicks or drags, that trigger the vulnerable code path. No prior authentication is required. Because the attack relies on social engineering to induce the gesture, phishing and malvertising are realistic delivery channels.

No verified public proof-of-concept code is available. Technical details are tracked in the Chromium Issue Tracker Entry and the Google Chrome Update Announcement.

Detection Methods for CVE-2024-5842

Indicators of Compromise

Chrome browser processes crashing with access violation or segmentation fault signatures correlated with recent navigation to untrusted sites.
Outbound HTTPS connections to newly registered or low-reputation domains immediately preceding browser instability.
Endpoints running Chrome versions older than 126.0.6478.54 after the patch release window.

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag any build below 126.0.6478.54.
Monitor browser process telemetry for abnormal crash frequencies, suspicious child process creation, and unexpected memory access patterns following web navigation events.
Correlate web proxy logs with endpoint crash events to identify users who visited suspicious pages prior to anomalous Chrome behavior.

Monitoring Recommendations

Enable enterprise Chrome update reporting through Chrome Browser Cloud Management to track patch deployment status.
Forward browser crash dumps and process telemetry to a centralized SIEM for retrospective hunting.
Alert on Chrome processes spawning unusual child binaries or writing to sensitive filesystem locations.

How to Mitigate CVE-2024-5842

Immediate Actions Required

Update Google Chrome to version 126.0.6478.54 or later on all managed endpoints, including Windows, macOS, and Linux installations.
Apply the corresponding Fedora package updates for Fedora 39 and Fedora 40 referenced in the Fedora package announcements.
Restart Chrome after updating to ensure the patched binary is loaded into memory.

Patch Information

Google released the fix in the Stable channel desktop update for Chrome 126.0.6478.54. Distribution packages for Fedora are available through the Fedora package announcements. Refer to the Google Chrome Update Announcement, the Fedora Package Announcement, and the second Fedora Package Announcement for package details.

Workarounds

Restrict browsing to trusted sites through enterprise web filtering until patches are deployed.
Deploy enterprise policies to enforce automatic Chrome updates and prevent users from delaying restarts.
Educate users to avoid performing UI interactions on unfamiliar pages, particularly those delivered through unsolicited links.

bash

# Verify installed Chrome version on Linux
google-chrome --version

# Update Chrome on Fedora
sudo dnf update google-chrome-stable

# Update Chromium package on Fedora
sudo dnf update chromium