Chrome CVE-2024-4671: Exploited Visuals Sandbox Escape

What to do

1. Confirm Chrome is 124.0.6367.201 or later (chrome://settings/help); any auto-updating install is now on 156.
2. Check Android devices for stale Chrome with adb shell dumpsys package com.android.chrome | grep versionName, and turn on Play auto-updates or retire the device.
3. In managed fleets, report Chrome and Edge versions and remove version pins or update deferrals that kept browsers on 2024-era builds.
4. Inventory Electron apps and update or remove any built on Electron older than 28.3.2, 29.3.3 or 30.0.3.
5. Search DNS and proxy logs for track-adv[.]com, the exploit server Google TAG reported.

How to check if you are affected or compromised

• Search DNS, proxy and mobile-management logs for track-adv[.]com, especially requests to /analytics.php?personalization_id=, and for visits from Android devices to mfa.gov[.]mn in late July 2024.
• Check endpoint and mobile security tools for the TAG-published payload hashes 21682218bde550b2f06ee2bb4f6a39cff29672ebe27acbb3cee5db79bf6d7297 (reconnaissance) and df21c2615bc66c369690cf35aa5a681aed1692a5255d872427a2970e2894b2e3 (ANDROSNATCH cookie stealer).
• If an Android device running Chrome 121 to 123 hit those indicators, assume its browser cookies, saved passwords and history were stolen: sign out all sessions and rotate passwords.

What happened#

On May 9, 2024, Google shipped Chrome 124.0.6367.201/.202 for Windows and Mac and 124.0.6367.201 for Linux, with a single security fix. It was CVE-2024-4671, a use-after-free in the Visuals component, reported anonymously on May 7. The release notes say "Google is aware that an exploit for CVE-2024-4671 exists in the wild." The CVE record says an attacker "who had compromised the renderer process" could use it to escape Chrome's sandbox. That makes it the second half of an exploit chain. NVD scores it CVSS 3.1 9.6. CISA added it to KEV on May 13, 2024.

In August 2024, Google TAG described how the bug was used after the patch. At the end of July 2024, a watering hole on mfa.gov[.]mn sent Android users to track-adv[.]com. That site served a chain built from CVE-2024-5274 for the renderer and CVE-2024-4671 for the sandbox escape, aimed at Chrome versions m121 to m123. TAG attributes the campaign to APT29 with moderate confidence. It calls these n-day exploits, "identical or strikingly similar" to ones from the spyware vendors Intellexa and NSO Group. The payload stole Chrome cookies, saved passwords, history and saved cards.

Who is affected#

Affected: Chrome before 124.0.6367.201, and Chromium-based software built before the fix. The fixed releases are:

• Extended Stable 124.0.6367.201.
• Chrome for Android 124.0.6367.171, released May 10.
• Microsoft Edge 124.0.2478.97, also May 10 (Edge notes). Microsoft adds that Edge's enhanced security mode mitigates the bug.
• Electron 30.0.3 and 29.3.3, which backported the fix on May 9 (release notes), and 28.3.2 on May 22.

Do you really need to act?#

Most people do not. Chrome auto-updates, and current Stable is 156. The TAG report is the reason to look anyway. A state-linked actor reused this bug two months after the patch, aiming at phones that had simply not updated. Exposure remains in four places:

• Android devices with Play updates off or no Play access.
• Kiosks and VDI images.
• Fleets that pin browser versions.
• Electron apps built on 2024-era Chromium.

Any of these can still be running Chrome 121 to 123.

What to do now#

1. Check desktops with google-chrome --version or, on Windows, (Get-Item "C:\Program Files\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion.
2. Check Android devices with adb shell dumpsys package com.android.chrome | grep versionName, or via your MDM's app inventory.
3. Look at chrome://policy on managed machines and remove update pins or deferrals that hold Chrome or Edge on old builds.
4. Update or remove Electron apps that predate the backports above.
5. Search DNS and proxy logs for track-adv[.]com.

How to tell if you were hit#

TAG published indicators for the July 2024 campaign:

• Requests to track-adv[.]com/analytics.php?personalization_id=.
• Payload hash 21682218bde550b2f06ee2bb4f6a39cff29672ebe27acbb3cee5db79bf6d7297 (reconnaissance).
• Payload hash df21c2615bc66c369690cf35aa5a681aed1692a5255d872427a2970e2894b2e3 (the ANDROSNATCH cookie stealer).

The stealer runs from Chrome's app data directory through LD_PRELOAD and deletes Chrome crash reports. Treat an Android device that matches these indicators as having lost its browser sessions and saved credentials. Sign out of every session, rotate passwords and review account activity.

Timeline#

• May 7, 2024 — An anonymous reporter tells Chrome about the bug as an in-the-wild zero-day.
• May 9, 2024 — Chrome 124.0.6367.201 ships, the CVE is published, and Electron backports the fix.
• May 10, 2024 — Chrome for Android and Edge ship fixes.
• May 13, 2024 — CISA adds CVE-2024-4671 to KEV, with a federal deadline of June 3.
• Aug 29, 2024 — Google TAG reports that, from the end of July 2024, a watering hole on mfa.gov[.]mn served the chain to Android users.

Vulnerability records

• CVE-2024-4671 · KEV 2024-05-13 · Use after free in Visuals in Google Chrome prior to 124.0.6367.201 allowed a remote attacker who had compromised the renderer process to potentially perform a…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Google Chrome Releases — Stable Channel Update for Desktop (May 9, 2024) chromereleases.googleblog.com
2. Google Chrome Releases — Chrome for Android Update (May 10, 2024) chromereleases.googleblog.com
3. CVE record — CVE-2024-4671 cve.org
4. NVD — CVE-2024-4671 nvd.nist.gov
5. CISA — Known Exploited Vulnerabilities: CVE-2024-4671 cisa.gov
6. Google TAG — State-backed attackers and commercial surveillance vendors repeatedly use the same exploits blog.google
7. Microsoft — Release notes for Microsoft Edge Security Updates learn.microsoft.com
8. Electron — v30.0.3 release notes github.com
9. Google Chrome Releases — Chrome 156 promoted to Stable (Oct 20, 2026) chromereleases.googleblog.com

Coverage and analysis

1. BleepingComputer — Google fixes fifth Chrome zero-day vulnerability exploited in attacks in 2024 bleepingcomputer.com