CVE-2024-7964: Google Chrome Use-After-Free Vulnerability

CVE-2024-7964 Overview

CVE-2024-7964 is a use-after-free vulnerability in the Passwords component of Google Chrome on Android. The flaw affects Chrome versions prior to 128.0.6613.84. A remote attacker can exploit heap corruption by serving a crafted HTML page to a targeted user. Google classified the Chromium security severity as High, and the vulnerability is tracked under CWE-416.

Critical Impact
Successful exploitation can corrupt heap memory in the renderer process, enabling arbitrary code execution within the browser sandbox after a user visits a malicious page.

Affected Products

Google Chrome on Android prior to 128.0.6613.84
Google Android (Chrome browser component)
Downstream Chromium-based mobile browsers incorporating the affected Passwords code

Discovery Timeline

2024-08-21 - CVE-2024-7964 published to NVD
2024-08-27 - Last updated in NVD database

Technical Details for CVE-2024-7964

Vulnerability Analysis

The vulnerability resides in the Passwords feature of Chrome on Android. A use-after-free condition occurs when the browser references a heap object after it has been freed. Attackers who control the timing of allocation and deallocation can place attacker-influenced data into the reclaimed memory region. When Chrome subsequently dereferences the stale pointer, the corrupted state can be leveraged to redirect execution flow. Exploitation requires user interaction, specifically navigation to a crafted HTML page hosted by the attacker.

Root Cause

The root cause is improper lifetime management of an object within the Passwords component, classified as [CWE-416] Use After Free. Code paths in the password-handling logic retain a reference to an object that has already been released. Subsequent operations on the dangling pointer trigger heap corruption. The Chromium issue tracker entry Issue 358296941 documents the internal bug record.

Attack Vector

The attack is network-based and requires no privileges, only user interaction. An attacker hosts a crafted HTML page and lures a victim to visit it through phishing, malvertising, or a compromised site. Once loaded, the page triggers the password-component code path that frees and then reuses the object. The resulting heap corruption can be chained with a sandbox escape to achieve broader compromise of the Android device.

No public proof-of-concept code is available for this issue. Technical details are limited to the Chromium Issue Tracker Entry and the Google Chrome Update Blog.

Detection Methods for CVE-2024-7964

Indicators of Compromise

Chrome for Android renderer process crashes with heap corruption signatures shortly after visiting an untrusted page
Unexpected child process spawns or native library loads originating from the Chrome app on Android
Outbound connections from the Chrome process to attacker-controlled infrastructure following navigation events

Detection Strategies

Inventory installed Chrome versions on managed Android fleets and flag any build below 128.0.6613.84
Monitor mobile device management (MDM) telemetry for Chrome crash reports correlated with browsing activity
Correlate web proxy and DNS logs with user navigation to identify visits to suspicious HTML payloads delivering exploit content

Monitoring Recommendations

Enable Chrome Enterprise reporting to centralize crash and version data for analysis
Track EPSS exploitability trends for CVE-2024-7964 and adjust priority as scoring changes
Ingest browser and mobile endpoint telemetry into a centralized analytics platform for cross-correlation with threat intelligence on Chrome n-day exploitation campaigns

How to Mitigate CVE-2024-7964

Immediate Actions Required

Update Google Chrome on all Android devices to version 128.0.6613.84 or later through the Google Play Store
Use MDM policies to enforce minimum Chrome versions and block usage of outdated builds
Inform users to avoid clicking links from untrusted sources until patching is verified across the fleet

Patch Information

Google released the fix in Chrome 128.0.6613.84 for Android. Patch details and release notes are available in the Google Chrome Update Blog. Administrators should validate Play Store auto-update settings and confirm rollout completion via MDM compliance reporting.

Workarounds

Restrict Chrome usage on Android until the patched version is installed, routing browsing through an alternate vetted browser
Disable Chrome password autofill and password manager features via enterprise policy to reduce exposure of the vulnerable component
Apply network-layer filtering to block known malicious HTML payload delivery domains identified in threat intelligence feeds

bash

# Verify installed Chrome version on a managed Android device via ADB
adb shell dumpsys package com.android.chrome | grep versionName
# Expected output should show 128.0.6613.84 or higher