CVE-2024-6997: Google Chrome Use After Free Vulnerability

CVE-2024-6997 Overview

CVE-2024-6997 is a use-after-free vulnerability [CWE-416] in the Tabs component of Google Chrome versions prior to 127.0.6533.72. A remote attacker who convinces a user to perform specific UI gestures can trigger heap corruption through a crafted HTML page. Successful exploitation can lead to arbitrary code execution in the renderer context.

The issue affects desktop builds of Chrome across supported platforms. Google released a fix in the Stable channel update on July 23, 2024. The flaw requires user interaction but no authentication, and it carries network attack reachability.

Critical Impact
Remote attackers can exploit heap corruption in the Tabs component to achieve code execution after luring a user to a malicious page and performing specific UI gestures.

Affected Products

Google Chrome (Desktop) versions prior to 127.0.6533.72
Chromium-based browsers sharing the affected Tabs implementation
All desktop platforms (Windows, macOS, Linux) running pre-patch Chrome builds

Discovery Timeline

2024-07-23 - Google releases Chrome 127.0.6533.72 to the Stable channel addressing the issue
2024-08-06 - CVE-2024-6997 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-6997

Vulnerability Analysis

The vulnerability is a use-after-free condition in Chrome's Tabs component. Use-after-free flaws occur when code continues to reference memory after it has been released. An attacker who controls the contents of the freed allocation can hijack control flow when the dangling pointer is reused.

In this case, the trigger requires a crafted HTML page combined with specific user interface gestures. Those gestures cause the browser to operate on a tab-related object that has already been freed. The resulting heap corruption is suitable for memory disclosure or arbitrary code execution within the renderer or browser process, depending on the object lifetime involved.

The Chromium project rated the underlying issue as Medium severity, while NVD assigned a higher score reflecting the impact on confidentiality, integrity, and availability when exploitation succeeds.

Root Cause

The root cause is improper lifetime management of an object in the Tabs subsystem. Code paths reachable through user-driven UI events retain or reuse a pointer after the underlying allocation has been released. The condition maps to [CWE-416] Use After Free.

Attack Vector

Exploitation proceeds in three steps. First, the attacker hosts a crafted HTML page and lures a victim to visit it. Second, the page induces or requires the user to perform specific UI gestures involving tabs. Third, the resulting sequence frees an internal object that is then dereferenced, producing heap corruption that an attacker can shape into code execution.

No verified public exploit code is available for CVE-2024-6997. The vulnerability mechanism is described in the upstream Chromium issue tracker entry referenced by Google. See the Chromium Issue Tracker Entry and the Google Chrome Update Announcement for vendor details.

Detection Methods for CVE-2024-6997

Indicators of Compromise

Chrome renderer or browser process crashes with heap corruption signatures (for example HEAP-BUFFER-OVERFLOW, USE-AFTER-FREE) recorded in crashpad reports.
Unexpected child process creation from chrome.exe following navigation to an untrusted page.
Outbound connections from Chrome processes to previously unseen domains immediately after a user interacts with a new tab.

Detection Strategies

Inventory installed Chrome versions across the fleet and flag any build earlier than 127.0.6533.72.
Hunt for browser process crashes correlated with recent navigations to externally hosted HTML content.
Apply web filtering and URL reputation checks to block known malicious landing pages that attempt browser exploitation.

Monitoring Recommendations

Forward Chrome crash telemetry and Windows Error Reporting events to a central log store for review.
Monitor for anomalous process trees where chrome.exe spawns shells, scripting engines, or LOLBins.
Track endpoint EDR alerts for in-memory shellcode patterns originating from browser processes.

How to Mitigate CVE-2024-6997

Immediate Actions Required

Update Google Chrome to version 127.0.6533.72 or later on all desktop endpoints.
Restart Chrome after the update so the patched binaries are loaded into memory.
Update Chromium-based browsers (Edge, Brave, Opera, Vivaldi) to vendor releases that incorporate the upstream fix.

Patch Information

Google addressed CVE-2024-6997 in the Stable channel update released on July 23, 2024, with Chrome version 127.0.6533.72 for Windows, macOS, and Linux. Refer to the Google Chrome Update Announcement for release details. Enterprise administrators should ensure Chrome auto-update is enabled or deploy the new MSI/PKG/DEB packages through their management platform.

Workarounds

Restrict browsing to trusted sites using URL allow-lists where patching is delayed.
Enforce Chrome's Site Isolation and Enhanced Safe Browsing policies via group policy or the Chrome Enterprise console.
Disable or limit untrusted browser extensions that can manipulate tab behavior on behalf of pages.

bash

# Verify the installed Chrome version on Linux/macOS
google-chrome --version

# Windows: query the installed version from the registry
reg query "HKLM\SOFTWARE\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv

# Force update check from CLI (Linux)
sudo apt-get update && sudo apt-get install --only-upgrade google-chrome-stable