CVE-2024-8637 Overview
CVE-2024-8637 is a use-after-free vulnerability in the Media Router component of Google Chrome on Android. Versions prior to 128.0.6613.137 are affected. A remote attacker can trigger heap corruption by convincing a user to visit a crafted HTML page. Successful exploitation can lead to arbitrary code execution within the renderer process. The flaw is tracked under CWE-416 and was rated High severity by the Chromium security team.
Critical Impact
Remote attackers can exploit heap corruption through a crafted web page, potentially leading to code execution in the browser process on Android devices.
Affected Products
- Google Chrome on Android prior to 128.0.6613.137
- Google Android platform hosting vulnerable Chrome builds
- Chromium-based browsers sharing the affected Media Router code path
Discovery Timeline
- 2024-09-11 - CVE-2024-8637 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-8637
Vulnerability Analysis
The vulnerability resides in the Media Router subsystem of Chrome, which manages media presentation, casting, and remote playback between web content and external devices. A use-after-free condition occurs when the component continues to reference a heap object after it has been deallocated. Attackers can manipulate the freed memory region, controlling the contents that the dangling pointer references. This produces heap corruption suitable for further exploitation in the renderer sandbox.
The issue requires user interaction, meaning the victim must load attacker-controlled web content. Network-based delivery through phishing, malvertising, or compromised sites is the expected attack scenario. Exploitation impacts confidentiality, integrity, and availability of the browser session.
Root Cause
The root cause is improper lifetime management of an object handled by the Media Router. The component releases memory but retains references that are later dereferenced. JavaScript executing in the page can drive the object lifecycle through Presentation API or Remote Playback API calls, causing the freed allocation to be reused with attacker-controlled data.
Attack Vector
An attacker hosts a crafted HTML page that invokes Media Router functionality in a specific sequence. When the victim opens the page in a vulnerable Chrome on Android build, the page triggers the free and subsequent use of the dangling pointer. Heap grooming techniques allow the attacker to place controlled data into the reclaimed allocation, enabling memory corruption primitives.
No verified public proof-of-concept code is available. See the Chromium Issue Tracker Entry and the Google Chrome Stable Update for vendor details.
Detection Methods for CVE-2024-8637
Indicators of Compromise
- Chrome on Android renderer process crashes referencing Media Router or media_router symbols
- Outbound connections from mobile devices to unfamiliar domains immediately following Chrome tab launches
- HTML or JavaScript payloads invoking Presentation API or Remote Playback API in unusual sequences
Detection Strategies
- Inventory Chrome on Android versions across managed devices and flag any build below 128.0.6613.137
- Inspect web proxy and DNS logs for access to pages serving anomalous Media Router API calls
- Correlate Chrome crash telemetry with browsing history to surface potential exploitation attempts
Monitoring Recommendations
- Forward mobile browser crash reports and MDM telemetry into a central analytics platform for triage
- Monitor enterprise mobility management consoles for delayed Chrome update compliance
- Track threat intelligence feeds for emerging exploit chains targeting Chromium Media Router
How to Mitigate CVE-2024-8637
Immediate Actions Required
- Update Google Chrome on Android to 128.0.6613.137 or later through the Google Play Store
- Push the updated Chrome build to managed devices via mobile device management policies
- Advise users to avoid opening untrusted links until patches are confirmed installed
Patch Information
Google addressed CVE-2024-8637 in Chrome 128.0.6613.137 for Android. Details are documented in the Google Chrome Stable Update release notes. Apply the vendor patch as the primary remediation. Chromium-based browsers that consume the same upstream fix should also be updated once their maintainers ship the corresponding version.
Workarounds
- Restrict casting and remote playback usage on managed Android devices until patching is complete
- Block known malicious domains at the network level to limit delivery of crafted HTML pages
- Enforce phishing-resistant browsing policies and user awareness training to reduce click-through on untrusted links
# Verify Chrome version on Android via adb
adb shell dumpsys package com.android.chrome | grep versionName
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
