CVE-2024-1673: 
vulnerability analysis and mitigation

CVE-2024-1673 is a Use-after-free vulnerability discovered in the Accessibility component of Google Chrome versions prior to 122.0.6261.57. The vulnerability was disclosed on February 20, 2024, and was assigned a Medium severity rating by the Chromium security team (Chrome Release).

The vulnerability is classified as a Use-after-free (CWE-416) issue in the Accessibility component of Chrome. It received a CVSS v3.1 base score of 8.8 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The vulnerability was reported by security researcher Weipeng Jiang (@Krace) of VRI on January 11, 2024, and was awarded a $2,000 bounty (NVD).

The vulnerability allows a remote attacker who has already compromised the renderer process to potentially exploit heap corruption through specific UI gestures. This could lead to arbitrary code execution within the context of the browser (Chrome Release).

Google has released a fix in Chrome version 122.0.6261.57. Users are advised to update their Chrome browsers to this version or later. The fix has been distributed to Windows, Mac, and Linux platforms (Chrome Release).