CVE-2024-7534: Google Chrome Buffer Overflow Vulnerability

CVE-2024-7534 Overview

CVE-2024-7534 is a heap buffer overflow vulnerability in the Layout component of Google Chrome versions prior to 127.0.6533.99. A remote attacker can exploit heap corruption by serving a crafted HTML page to a victim browser. Chromium security rates this issue as High severity, and successful exploitation can lead to arbitrary code execution within the renderer process. The vulnerability requires user interaction, typically navigating to an attacker-controlled page. It affects all desktop platforms running vulnerable Chrome builds and any Chromium-based browser sharing the same Layout code paths.

Critical Impact

A remote attacker can trigger heap corruption in the Chrome renderer through a malicious HTML page, potentially leading to code execution and sandbox-assisted compromise of the user session.

Affected Products

• Google Chrome (Desktop) versions prior to 127.0.6533.99
• Chromium-based browsers incorporating the vulnerable Layout code
• All operating systems supported by Chrome (Windows, macOS, Linux)

Discovery Timeline

• 2024-08-06 - CVE-2024-7534 published to NVD
• 2024-10-15 - Last updated in NVD database

Technical Details for CVE-2024-7534

Vulnerability Analysis

The flaw is a heap buffer overflow in Chrome's Layout engine, the component responsible for computing the visual position and size of DOM elements. When the renderer processes specific HTML structures, the Layout code writes past the bounds of a heap-allocated buffer. This corrupts adjacent heap memory, which an attacker can shape to overwrite control data such as object pointers or virtual table entries.

The issue maps to [CWE-122] (Heap-based Buffer Overflow), [CWE-787] (Out-of-bounds Write), and [CWE-120] (Buffer Copy without Checking Size of Input). Exploitation occurs in the renderer process, which is sandboxed, but pairing this bug with a sandbox escape would yield full host compromise. Public exploit code is not currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Root Cause

The root cause is missing or incorrect bounds checking inside a Layout routine that copies or initializes data into a heap allocation. Specific element combinations cause the engine to under-allocate or miscalculate the destination buffer size, producing an out-of-bounds write during layout computation. The upstream Chromium fix is tracked in issue 352467338.

Attack Vector

Exploitation is network-based and requires user interaction. The attacker hosts a crafted HTML page and lures the victim to visit it through phishing, malvertising, or a compromised site. Once the page loads, the Layout engine processes the malicious markup and triggers the heap overflow inside the renderer. The vulnerability manifests during layout computation; see the Chromium Issue Tracker Entry for technical context. No authentication is required, and no privileged access on the target is needed.

Detection Methods for CVE-2024-7534

Indicators of Compromise

• Chrome renderer process crashes (chrome.exe --type=renderer) with heap corruption signatures shortly after navigation
• Browser telemetry showing unexpected child process spawns from chrome.exe following web navigation
• Outbound connections from Chrome renderer or sandbox-escaping processes to unfamiliar domains immediately after page load

Detection Strategies

• Inventory all endpoints and identify Chrome installations with a version below 127.0.6533.99 using software asset management or EDR queries
• Hunt for renderer crash artifacts in Windows Error Reporting (WER) and macOS CrashReporter logs that reference Layout or Blink modules
• Correlate web proxy logs with EDR process telemetry to flag sessions where Chrome navigation precedes anomalous process or network behavior

Monitoring Recommendations

• Enable browser version reporting through Chrome Enterprise Core or equivalent management tooling and alert on out-of-date clients
• Monitor for child processes launched by chrome.exe that are not on an approved allowlist
• Track DNS and HTTP requests from endpoints to newly registered or low-reputation domains tied to phishing or malvertising campaigns

How to Mitigate CVE-2024-7534

Immediate Actions Required

• Update Google Chrome to version 127.0.6533.99 or later on all managed endpoints
• Force restart of Chrome after deployment so the patched binary is loaded by all user sessions
• Verify Chromium-based browsers (Edge, Brave, Opera, Vivaldi) are running builds that incorporate the upstream fix

Patch Information

Google released the fix in the Stable channel update announced in the Google Chrome Update Announcement. The corrected build is 127.0.6533.99 for desktop platforms. Upstream tracking is available in the Chromium Issue Tracker Entry. Apply the update through Chrome's built-in updater, Chrome Enterprise policy, or your endpoint management platform.

Workarounds

• Restrict browsing to trusted sites using web filtering or DNS-layer controls until patches are deployed
• Enable Site Isolation and Enhanced Safe Browsing in Chrome to reduce exploitation impact
• Disable JavaScript on untrusted origins through enterprise policy for high-risk user groups

# Verify Chrome version on Linux/macOS endpoints
google-chrome --version

# Windows: check installed version via registry
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv

# Chrome Enterprise policy snippet to enforce minimum version and auto-update
# Place in /etc/opt/chrome/policies/managed/ on Linux
{
  "TargetVersionPrefix": "127.0.6533.99",
  "DefaultBrowserSettingEnabled": true,
  "SitePerProcess": true
}