Google · Chromium
CVE-2024-4671
Google Chromium Visuals Use-After-Free Vulnerability
O que é
Use after free in Visuals in Google Chrome prior to 124.0.6367.201 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
CISA: Google Chromium Visuals contains a use-after-free vulnerability that allows a remote attacker to exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
O que fazer
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Prazo para as agências federais dos EUA: 3 de junho de 2024
- Adicionada à lista da CISA
- 13 de maio de 2024
- Publicada
- 9 de maio de 2024
- Gravidade
- Crítica 9,6 CVSS 3.1
- Chance de ataques nos próximos 30 dias (EPSS)
- 8,3% entre os 5,1% mais altos de todas as vulnerabilidades conhecidas
- Fraqueza
- CWE-416
- Mais detalhes
- NVD · CVE.org · CISA
Todas as referências (7)
- https://chromereleases.googleblog.com/2024/05/stable-channel-update-for-desktop_9.html
- https://issues.chromium.org/issues/339266700
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NTSN22LNYXMWHV…
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FAWEKDQTHPN7NF…
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WSUWM73ZCXTN62…
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJP…
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BWFSZNNWSQYDRY…
Mais falhas exploradas de Google
| Adicionado | Vulnerabilidade | Produto | Gravidade | Chance de ataque |
|---|---|---|---|---|
| 17 de fev. de 2026 | CSS Use-After-Free | Chromium | Alto 8,8 | 55% |
| 12 de dez. de 2025 | Out of Bounds Memory Access | Chromium | Alto 8,8 | 55% |
| 22 de jul. de 2025 | ANGLE and GPU Improper Input Validation | Chromium | Alto 8,8 | 11% |
| 3 de nov. de 2021 | Race Condition | Chromium | Alto 8,8 | 24% |
| 3 de nov. de 2021 | Information Disclosure | Chromium | Média 6,5 | 20% |
| 27 de out. de 2026 | Unchecked Return Value | Brotli | Crítica 9,2 | 55% |
| 16 de set. de 2026 | Improper Authorization | Pixel | Alto 8,8 | 0,6% |
| 9 de set. de 2026 | Out of Bounds Write | Chromium V8 | Alto 8,8 | 3,5% |
Fontes: Known Exploited Vulnerabilities (CISA, domínio público), CVE records (cve.org) e EPSS (FIRST). A chance de ataque é a estimativa EPSS de que alguém tente explorar a falha nos próximos 30 dias.