Critical Use After Free Vulnerability in Chromium Package
Summary
CVE-2024-12694: Use after free in Compositing in Google Chrome prior to 131.0.6778.204 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Affects chromium versions 100.0.4896.127-1 – 99.0.4844.84-1~deb11u1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Chromium is an open-source web browser developed by Google, known for its speed, simplicity, and security features. It serves as the foundation for various browsers, including Google Chrome. The package is widely used across different operating systems and is integral to web browsing experiences. However, it is susceptible to vulnerabilities that can compromise user security, such as the recent use after free vulnerability identified as CVE-2024-12694.
Vulnerability Detail
The vulnerability, identified as CVE-2024-12694, is a use after free issue in the Compositing component of Google Chrome prior to version 131.0.6778.204. This flaw allows remote attackers to exploit heap corruption by crafting a malicious HTML page. If successfully exploited, it could lead to arbitrary code execution, potentially compromising the affected system and exposing sensitive user data.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users are advised to avoid visiting untrusted websites or clicking on suspicious links that may lead to crafted HTML pages until the package is updated.
Conclusion
The CVE-2024-12694 vulnerability poses a significant risk to users of the Chromium package, allowing potential exploitation through crafted HTML pages. It is crucial for users to update their packages to the latest patched versions to safeguard against this vulnerability. Additionally, employing safe browsing practices can help mitigate risks until updates are applied.
See every vulnerability recorded for chromium →
FAQ
CVE-2024-12694 is a use after free vulnerability in the Compositing component of Google Chrome that can be exploited via a malicious HTML page.
You can check if your version of Chromium is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor and alert for open-source vulnerabilities without requiring any installation.
If exploited, this vulnerability could lead to heap corruption, allowing attackers to execute arbitrary code and potentially gain access to sensitive information on the affected system.
Yes, a patch is available. Users should update to version 131.0.6778.204-1~deb12u1 for Debian 12 and 131.0.6778.204-1 for Debian 13 to mitigate the risk.
If you cannot update immediately, avoid visiting untrusted websites and clicking on suspicious links until you can apply the update.
References
Related vulnerabilities
Recent vulnerabilities recorded for chromium.
