CVE-2024-4671: Google Chrome Visuals use-after-free enables sandbox escape

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityCVSS 9.6 critical severity combined with CISA KEV listing and known exploitation makes this a top remediation priority.

What it is

CVE-2024-4671 is a use-after-free flaw in the Visuals component of Google Chrome prior to 124.0.6367.201. An attacker who has already compromised the renderer process can trigger it with a crafted HTML page to attempt a sandbox escape, which matters because it turns a renderer compromise into a broader host compromise.

Impact

An attacker gains the ability to escape the Chrome sandbox from an already-compromised renderer, potentially reaching the underlying operating system with high confidentiality, integrity and availability impact.

Attack surface

Reached over the network via a crafted HTML page, requiring user interaction to load the page and a pre-existing renderer compromise as a precondition. No privileges are required on the attacker's side per the CVSS vector.

Exploitation

CVE-2024-4671 is listed in CISA KEV with a due date of 2024-06-03, indicating known exploitation; EPSS 30-day probability is about 8.3 percent (94.7th percentile). No ransomware campaign use is documented.

What to do

• Update Google Chrome to 124.0.6367.201 or later, and apply the corresponding Fedora package updates.
• Verify browser version compliance across managed endpoints and block or restrict outdated Chrome builds.
• Enforce site isolation and keep renderer sandboxing enabled to limit the impact of renderer compromise.
• Reduce exposure to untrusted HTML through web filtering and user awareness of malicious pages.
• Track the CISA KEV due date of 2024-06-03 and confirm remediation before it.

Detection

• Monitor for Chrome processes spawning unexpected child processes or making unusual system calls indicative of sandbox escape attempts.
• Alert on renderer crashes or memory corruption events in the Visuals component via crash telemetry.
• Hunt for known exploitation indicators against the Chromium issue 339266700 and vendor advisory references.
• Audit endpoint browser versions to flag hosts still running Chrome below 124.0.6367.201.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.