CVE-2024-7967: Google Chrome Heap Buffer Overflow Flaw

CVE-2024-7967 Overview

CVE-2024-7967 is a heap buffer overflow vulnerability in the Fonts component of Google Chrome versions prior to 128.0.6613.84. A remote attacker can trigger heap corruption by serving a crafted HTML page to a victim browser. Successful exploitation can lead to arbitrary code execution within the renderer process. Google rated the Chromium security severity as High.

The vulnerability is classified under [CWE-122] (Heap-based Buffer Overflow) and [CWE-787] (Out-of-bounds Write). Exploitation requires user interaction, such as visiting a malicious or compromised website. The flaw affects all Chromium-based desktop builds prior to the fixed release on the Stable channel.

Critical Impact
Remote attackers can corrupt heap memory through a malicious web page, enabling potential renderer process compromise and arbitrary code execution on the victim host.

Affected Products

Google Chrome for Windows prior to 128.0.6613.84
Google Chrome for macOS prior to 128.0.6613.84
Google Chrome for Linux prior to 128.0.6613.84

Discovery Timeline

2024-08-21 - CVE-2024-7967 published to NVD
2024-08-21 - Google releases Stable channel update 128.0.6613.84 containing the fix
2024-08-27 - Last updated in NVD database

Technical Details for CVE-2024-7967

Vulnerability Analysis

The vulnerability resides in the Fonts subsystem of Chrome's rendering engine. A heap buffer overflow occurs when font data processing writes beyond the bounds of an allocated heap buffer. Attackers craft HTML pages containing malicious font references or font payloads to trigger the out-of-bounds write.

Heap corruption in the renderer process gives attackers a primitive to overwrite adjacent heap metadata or object pointers. With reliable heap shaping, this primitive can be converted into arbitrary read/write and ultimately code execution inside the Chrome renderer sandbox. Combined with a separate sandbox escape, it can lead to full host compromise.

Root Cause

The root cause is improper bounds validation during font glyph or table parsing in Chrome's Fonts component. Google has not published a detailed technical write-up, but the dual CWE classification ([CWE-122], [CWE-787]) indicates an out-of-bounds write into a heap-allocated buffer during font data handling.

Attack Vector

Exploitation is network-based and requires user interaction. The attacker hosts a crafted HTML page that loads a malicious font resource. When the victim visits the page in a vulnerable Chrome build, the Fonts component processes the payload and triggers the heap overflow. Common delivery methods include phishing links, malvertising, and compromised third-party content embedded in legitimate sites.

No verified public proof-of-concept code or active exploitation in the wild has been confirmed. See the Chromium Issue Tracker Entry for the restricted upstream bug report and the Google Chrome Desktop Update advisory for release details.

Detection Methods for CVE-2024-7967

Indicators of Compromise

Chrome renderer process crashes (chrome.exe child processes) with heap corruption signatures shortly after web browsing activity.
Outbound connections from browser processes to newly registered or low-reputation domains hosting font resources.
Unexpected child processes spawned from chrome.exe following a browsing session, indicating possible post-exploitation activity.

Detection Strategies

Inventory installed Chrome versions across endpoints and flag any build below 128.0.6613.84 as vulnerable.
Monitor endpoint telemetry for renderer crashes correlated with specific URLs or font MIME types (font/woff, font/woff2, font/ttf).
Inspect web proxy logs for HTML pages that reference unusual external font sources or embed large base64-encoded font payloads.

Monitoring Recommendations

Forward Chrome crash reports and process telemetry to a centralized analytics pipeline for anomaly review.
Alert on browser processes writing to or executing from user-writable directories such as %TEMP% or %APPDATA%.
Track browser version compliance as a continuous control rather than a one-time patch check.

How to Mitigate CVE-2024-7967

Immediate Actions Required

Update Google Chrome to version 128.0.6613.84 or later on all Windows, macOS, and Linux endpoints.
Restart Chrome after the update completes to ensure the patched binaries are loaded.
Verify enterprise managed-browser policies do not pin Chrome to a vulnerable build.

Patch Information

Google addressed CVE-2024-7967 in the Stable channel update 128.0.6613.84 released on August 21, 2024. Refer to the Google Chrome Desktop Update advisory for the full list of fixed issues. Chromium-derived browsers, including Microsoft Edge, Brave, Opera, and Vivaldi, should be updated to versions that incorporate the corresponding Chromium fix.

Workarounds

Restrict browsing to trusted sites through enterprise web filtering until patching is complete.
Deploy browser isolation or remote browser technologies for high-risk user populations.
Disable web fonts via enterprise policy where feasible, accepting the rendering trade-offs.

bash

# Verify Chrome version on Linux/macOS endpoints
google-chrome --version

# Windows: query installed Chrome version via registry
reg query "HKLM\SOFTWARE\Google\Chrome\BLBeacon" /v version

# Enterprise policy to enforce automatic updates (Windows registry)
# HKLM\SOFTWARE\Policies\Google\Update
#   UpdateDefault = 1 (REG_DWORD)  ; Always allow updates