CVE-2024-9961 Overview
CVE-2024-9961 is a use-after-free vulnerability in the ParcelTracking component of Google Chrome on iOS. The flaw affects Chrome on iOS versions prior to 130.0.6723.58. A remote attacker can exploit heap corruption by serving a crafted HTML page and convincing the user to perform specific UI gestures. Successful exploitation can compromise confidentiality, integrity, and availability of the browser process. Google has rated the Chromium security severity as Medium, while the NVD assigns a higher CVSS base score reflecting the broader impact profile. The vulnerability is tracked under CWE-416: Use After Free.
Critical Impact
Remote attackers can trigger heap corruption in Chrome on iOS through a crafted web page combined with user interaction, potentially leading to arbitrary code execution within the browser sandbox.
Affected Products
- Google Chrome on iOS versions prior to 130.0.6723.58
- Apple iPhone OS (host platform running vulnerable Chrome builds)
- Chromium-based browsers on iOS that share the affected ParcelTracking code path
Discovery Timeline
- 2024-10-15 - CVE-2024-9961 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-9961
Vulnerability Analysis
The vulnerability resides in Chrome's ParcelTracking feature, which manages parcel delivery tracking data surfaced through the browser UI on iOS. A use-after-free condition occurs when the component continues to reference heap memory after that memory has been freed. An attacker who serves a crafted HTML page and induces the victim to perform a specific UI gesture can drive Chrome into the vulnerable code path. Once the dangling pointer is dereferenced, the attacker gains a primitive for heap corruption. This primitive can be shaped into arbitrary read, write, or control-flow hijacking, depending on heap state at the moment of exploitation. EPSS data places exploitation probability at 0.377%, but the high impact metrics warrant prompt remediation. No public proof-of-concept or in-the-wild exploitation has been reported.
Root Cause
The root cause is improper object lifetime management within ParcelTracking on iOS. The code path retains a reference to a heap object after its backing memory has been released, violating the contract enforced by Chromium's memory model. When the freed region is reallocated and repopulated by attacker-controlled data, the stale reference operates on adversarial content.
Attack Vector
Exploitation requires network delivery of a crafted HTML page and user interaction through specific UI gestures on the iOS device. No prior authentication or elevated privileges are needed. The attacker hosts malicious content, lures the victim through phishing or a watering-hole site, and triggers the ParcelTracking code path once the user performs the required gesture. The vulnerability cannot be triggered without user engagement, which limits drive-by exploitation but remains viable against targeted users. See the Chromium Issue Tracker Detail for the upstream report and the Google Blog Chrome Update for the release notes.
Detection Methods for CVE-2024-9961
Indicators of Compromise
- Chrome for iOS process crashes or unexpected renderer termination on devices running versions earlier than 130.0.6723.58.
- Browser navigation history showing visits to unfamiliar pages immediately preceding crashes or anomalous behavior.
- Outbound connections from mobile devices to attacker-controlled domains hosting crafted HTML payloads.
Detection Strategies
- Inventory mobile fleets to identify Chrome for iOS installations below version 130.0.6723.58 and flag them for remediation.
- Monitor mobile device management (MDM) telemetry for Chrome version compliance and forced-update enforcement status.
- Use web proxy or secure web gateway logs to detect access to URLs flagged for browser exploitation or memory corruption payloads.
Monitoring Recommendations
- Correlate mobile browser crash telemetry with URL access logs to identify potential exploitation attempts against ParcelTracking.
- Track threat intelligence feeds for new exploit kits or public proof-of-concept code targeting CVE-2024-9961.
- Audit user reports of unusual Chrome iOS behavior following UI gestures on untrusted pages.
How to Mitigate CVE-2024-9961
Immediate Actions Required
- Update Google Chrome on iOS to version 130.0.6723.58 or later through the Apple App Store.
- Enforce automatic browser updates across managed iOS devices using MDM policies.
- Communicate the risk to end users and instruct them to avoid interacting with unsolicited links and unfamiliar parcel-tracking content.
Patch Information
Google released the fix in Chrome for iOS version 130.0.6723.58. The release is documented in the Google Blog Chrome Update, and the upstream issue is tracked at the Chromium Issue Tracker Detail. Upgrading to the patched build remediates the use-after-free condition in the ParcelTracking component.
Workarounds
- Restrict use of Chrome on iOS until the patched version is deployed, directing users to an updated alternative browser where feasible.
- Block known malicious domains at the network perimeter and on mobile secure web gateways to reduce exposure to crafted HTML payloads.
- Train users to avoid performing UI gestures prompted by untrusted web pages, particularly those impersonating parcel-tracking services.
# Verify Chrome for iOS version compliance via MDM query
# Example: Jamf Pro advanced search criteria
Application Title is "Chrome"
AND Application Version is less than "130.0.6723.58"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
