---
title: "Chrome CVE-2024-4671: Exploited Visuals Sandbox Escape"
url: https://erroneo.us/security/briefs/chrome-cve-2024-4671-visuals-use-after-free/
description: "Use-after-free sandbox escape fixed in Chrome 124.0.6367.201 in May 2024, later used on stale Android Chrome. Auto-updated browsers are fine; find stragglers."
type: security-brief
section: "Security Digest"
date_published: 2024-05-09
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2024-4671"]
severity: "high"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Chrome CVE-2024-4671: Exploited Visuals Sandbox Escape

**Verdict: Check exposure.** Any browser that auto-updated since May 2024 is long past this fix; the real lesson is that attackers reused it months later against Android phones that had not updated, so find the devices and embedded Chromium builds that still lag.

- **Who must act:** Owners of Android devices or kiosks whose Chrome does not update from Google Play, fleets that pin Chrome or Edge versions, and anyone shipping or running Electron apps built on Chromium older than May 2024.
- **Who can relax:** Users of auto-updating Chrome (124.0.6367.201 or later) or Edge (124.0.2478.97 or later), which is nearly every consumer desktop and phone with Play updates on.
- **Affected:** Google Chrome before 124.0.6367.201 (Windows, Mac, Linux); Chrome for Android before 124.0.6367.171; Microsoft Edge before 124.0.2478.97; Electron releases without the backport (before 28.3.2, 29.3.3 or 30.0.3 on those lines); Other Chromium-based browsers until their vendors ship the fix
- **Fixed:** Chrome 124.0.6367.201/.202 Windows and Mac, 124.0.6367.201 Linux (May 9, 2024); Chrome Extended Stable 124.0.6367.201 Windows and Mac; Chrome for Android 124.0.6367.171 (May 10, 2024); Microsoft Edge 124.0.2478.97 (May 10, 2024); Electron 30.0.3, 29.3.3 (May 9, 2024) and 28.3.2 (May 22, 2024)
- **CVEs:** CVE-2024-4671
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Confirm Chrome is 124.0.6367.201 or later (chrome://settings/help); any auto-updating install is now on 156.
2. Check Android devices for stale Chrome with adb shell dumpsys package com.android.chrome | grep versionName, and turn on Play auto-updates or retire the device.
3. In managed fleets, report Chrome and Edge versions and remove version pins or update deferrals that kept browsers on 2024-era builds.
4. Inventory Electron apps and update or remove any built on Electron older than 28.3.2, 29.3.3 or 30.0.3.
5. Search DNS and proxy logs for track-adv[.]com, the exploit server Google TAG reported.

### How to check if you are affected

- Search DNS, proxy and mobile-management logs for track-adv[.]com, especially requests to /analytics.php?personalization_id=, and for visits from Android devices to mfa.gov[.]mn in late July 2024.
- Check endpoint and mobile security tools for the TAG-published payload hashes 21682218bde550b2f06ee2bb4f6a39cff29672ebe27acbb3cee5db79bf6d7297 (reconnaissance) and df21c2615bc66c369690cf35aa5a681aed1692a5255d872427a2970e2894b2e3 (ANDROSNATCH cookie stealer).
- If an Android device running Chrome 121 to 123 hit those indicators, assume its browser cookies, saved passwords and history were stolen: sign out all sessions and rotate passwords.

## What happened

On May 9, 2024, Google shipped Chrome 124.0.6367.201/.202 for Windows and Mac and 124.0.6367.201 for Linux, with a single security fix. It was [CVE-2024-4671](https://www.cve.org/CVERecord?id=CVE-2024-4671), a use-after-free in the Visuals component, reported anonymously on May 7. The [release notes](https://chromereleases.googleblog.com/2024/05/stable-channel-update-for-desktop_9.html) say "Google is aware that an exploit for CVE-2024-4671 exists in the wild." The CVE record says an attacker "who had compromised the renderer process" could use it to escape Chrome's sandbox. That makes it the second half of an exploit chain. [NVD](https://nvd.nist.gov/vuln/detail/CVE-2024-4671) scores it CVSS 3.1 9.6. CISA added it to [KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-4671) on May 13, 2024.

In August 2024, [Google TAG](https://blog.google/threat-analysis-group/state-backed-attackers-and-commercial-surveillance-vendors-repeatedly-use-the-same-exploits/) described how the bug was used after the patch. At the end of July 2024, a watering hole on mfa.gov[.]mn sent Android users to track-adv[.]com. That site served a chain built from CVE-2024-5274 for the renderer and CVE-2024-4671 for the sandbox escape, aimed at Chrome versions m121 to m123. TAG attributes the campaign to APT29 with moderate confidence. It calls these n-day exploits, "identical or strikingly similar" to ones from the spyware vendors Intellexa and NSO Group. The payload stole Chrome cookies, saved passwords, history and saved cards.

## Who is affected

Affected: Chrome before 124.0.6367.201, and Chromium-based software built before the fix. The fixed releases are:

- Extended Stable 124.0.6367.201.
- [Chrome for Android 124.0.6367.171](https://chromereleases.googleblog.com/2024/05/chrome-for-android-update_10.html), released May 10.
- Microsoft Edge 124.0.2478.97, also May 10 ([Edge notes](https://learn.microsoft.com/en-us/deployedge/microsoft-edge-relnotes-security)). Microsoft adds that Edge's enhanced security mode mitigates the bug.
- Electron 30.0.3 and 29.3.3, which backported the fix on May 9 ([release notes](https://github.com/electron/electron/releases/tag/v30.0.3)), and 28.3.2 on May 22.

## Do you really need to act?

Most people do not. Chrome auto-updates, and current Stable is [156](https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html). The TAG report is the reason to look anyway. A state-linked actor reused this bug two months after the patch, aiming at phones that had simply not updated. Exposure remains in four places:

- Android devices with Play updates off or no Play access.
- Kiosks and VDI images.
- Fleets that pin browser versions.
- Electron apps built on 2024-era Chromium.

Any of these can still be running Chrome 121 to 123.

## What to do now

1. Check desktops with `google-chrome --version` or, on Windows, `(Get-Item "C:\Program Files\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion`.
2. Check Android devices with `adb shell dumpsys package com.android.chrome | grep versionName`, or via your MDM's app inventory.
3. Look at `chrome://policy` on managed machines and remove update pins or deferrals that hold Chrome or Edge on old builds.
4. Update or remove Electron apps that predate the backports above.
5. Search DNS and proxy logs for `track-adv[.]com`.

## How to tell if you were hit

TAG published indicators for the July 2024 campaign:

- Requests to `track-adv[.]com/analytics.php?personalization_id=`.
- Payload hash `21682218bde550b2f06ee2bb4f6a39cff29672ebe27acbb3cee5db79bf6d7297` (reconnaissance).
- Payload hash `df21c2615bc66c369690cf35aa5a681aed1692a5255d872427a2970e2894b2e3` (the ANDROSNATCH cookie stealer).

The stealer runs from Chrome's app data directory through `LD_PRELOAD` and deletes Chrome crash reports. Treat an Android device that matches these indicators as having lost its browser sessions and saved credentials. Sign out of every session, rotate passwords and review account activity.

## Timeline

- May 7, 2024 — An anonymous reporter tells Chrome about the bug as an in-the-wild zero-day.
- May 9, 2024 — Chrome 124.0.6367.201 ships, the CVE is published, and Electron backports the fix.
- May 10, 2024 — Chrome for Android and Edge ship fixes.
- May 13, 2024 — CISA adds CVE-2024-4671 to KEV, with a federal deadline of June 3.
- Aug 29, 2024 — Google TAG reports that, from the end of July 2024, a watering hole on mfa.gov[.]mn served the chain to Android users.

## Sources

1. [Google Chrome Releases — Stable Channel Update for Desktop (May 9, 2024)](https://chromereleases.googleblog.com/2024/05/stable-channel-update-for-desktop_9.html)
2. [Google Chrome Releases — Chrome for Android Update (May 10, 2024)](https://chromereleases.googleblog.com/2024/05/chrome-for-android-update_10.html)
3. [CVE record — CVE-2024-4671](https://www.cve.org/CVERecord?id=CVE-2024-4671)
4. [NVD — CVE-2024-4671](https://nvd.nist.gov/vuln/detail/CVE-2024-4671)
5. [CISA — Known Exploited Vulnerabilities: CVE-2024-4671](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-4671)
6. [Google TAG — State-backed attackers and commercial surveillance vendors repeatedly use the same exploits](https://blog.google/threat-analysis-group/state-backed-attackers-and-commercial-surveillance-vendors-repeatedly-use-the-same-exploits/)
7. [Microsoft — Release notes for Microsoft Edge Security Updates](https://learn.microsoft.com/en-us/deployedge/microsoft-edge-relnotes-security)
8. [Electron — v30.0.3 release notes](https://github.com/electron/electron/releases/tag/v30.0.3)
9. [Google Chrome Releases — Chrome 156 promoted to Stable (Oct 20, 2026)](https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html)
10. [BleepingComputer — Google fixes fifth Chrome zero-day vulnerability exploited in attacks in 2024](https://www.bleepingcomputer.com/news/security/google-fixes-fifth-chrome-zero-day-vulnerability-exploited-in-attacks-in-2024/)

---
Source page: https://erroneo.us/security/briefs/chrome-cve-2024-4671-visuals-use-after-free/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt