CVE-2024-4671: critical vulnerability in Google Chrome
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA.
Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
A flaw in Google Chrome's visual rendering allows an attacker who already controls the browser's renderer process to escape the security sandbox through a specially crafted webpage, potentially gaining full system access.
Use-after-free vulnerability in the Visuals component allows a compromised renderer process to bypass sandbox isolation via crafted HTML. The attacker must first compromise the renderer, then trigger memory access after object deallocation to achieve arbitrary code execution with elevated privileges.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.