CVE-2024-4671

CVE-2024-4671 is a use-after-free vulnerability in the Visuals component of Google Chrome prior to version 124.0.6367.201. The CVSS v3.1 vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, resulting in a base score of 9.6 (Critical).

The Visuals component in Chrome is responsible for managing the visual frame tree, which represents the rendered content of web pages and coordinates compositing operations between the renderer and the GPU process. The use-after-free occurs when a visual frame object is deallocated during a rendering pipeline transition, but a reference to the freed object persists in another part of the compositing or display logic. When this stale reference is subsequently dereferenced, the attacker can exploit the condition by controlling the contents of the reallocated memory region through heap spraying or other memory manipulation techniques.

The critical aspect of this vulnerability is the Scope change (S:C), which indicates that exploitation in the renderer process can affect the broader system beyond the sandbox boundary. Chrome's multi-process architecture runs renderer processes in a restricted sandbox with limited system access. A use-after-free in the Visuals component, which interfaces with the GPU process and compositor, can be leveraged to escape this sandbox because the compositing pipeline crosses privilege boundaries between the sandboxed renderer and the more privileged GPU or browser process.

The Attack Vector (AV:N) confirms remote exploitation via a crafted web page. Attack Complexity (AC:L) is low, though the actual exploit chain requires renderer compromise first. Privileges Required (PR:N) is none, as no authentication is needed. User Interaction (UI:R) requires the victim to visit a malicious page. All CIA impact metrics are rated high (C:H/I:H/A:H), and the changed scope means these impacts extend beyond the vulnerable component to the broader system.