CVE-2024-2400: 
vulnerability analysis and mitigation

CVE-2024-2400 is a high-severity vulnerability affecting Google Chrome versions prior to 122.0.6261.128. The vulnerability was discovered on March 1, 2024, by zh1x1an1221 of Ant Group Tianqiong Security Lab and was publicly disclosed on March 12, 2024. This security flaw affects the Performance Manager component in Google Chrome and impacts all platforms including Windows, Mac, and Linux (Chrome Release).

The vulnerability is classified as a Use-after-free (UAF) issue in the Performance Manager component of Google Chrome. It has been assigned a CVSS v3.1 base score of 8.8 (High), with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The vulnerability allows a remote attacker to potentially exploit heap corruption through a specially crafted HTML page (NVD).

If successfully exploited, this vulnerability could lead to heap corruption, potentially allowing attackers to execute arbitrary code within the context of the browser. The high CVSS score indicates that successful exploitation could result in significant impacts to confidentiality, integrity, and availability of the affected system (NVD).

The vulnerability requires user interaction and can be exploited remotely through a crafted HTML page. The attack complexity is considered low, requiring no special privileges for exploitation (NVD).

Google has released version 122.0.6261.128 of Chrome to address this vulnerability. Users are advised to update their Chrome browsers to this version or later. The fix has also been incorporated into Fedora Linux distributions 38 and 39 through package updates (Fedora Update, Fedora Update 38).