Vulnerability DatabaseCVE-2024-3170

CVE-2024-3170:
Google Chrome vulnerability analysis and mitigation

Overview

A high-severity use-after-free vulnerability (CVE-2024-3170) was discovered in the WebRTC component of Google Chrome versions prior to 121.0.6167.85. The vulnerability allows remote attackers to potentially exploit heap corruption through a specially crafted HTML page (Chrome Release).

Technical details

The vulnerability is classified as a use-after-free (CWE-416) issue in the WebRTC component of Google Chrome. It has received a CVSS v3.1 base score of 8.8 (High), with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating that it can be exploited remotely with low attack complexity, requires no privileges but does need user interaction, and can potentially result in high impacts to confidentiality, integrity, and availability (NVD Database).

Impact

The vulnerability could lead to heap corruption if successfully exploited, potentially allowing attackers to execute arbitrary code within the context of the browser. The high CVSS score indicates significant potential impact on system security, affecting confidentiality, integrity, and availability of the affected system (NVD Database).

Mitigation and workarounds

Google has released a fix in Chrome version 121.0.6167.85 for Mac and Linux, and versions 121.0.6167.85/.86 for Windows. Users are strongly advised to update their Chrome browsers to these versions or later to mitigate the vulnerability (Chrome Release).

Community reactions

The vulnerability was reported by an anonymous researcher and was awarded a bug bounty of $9,000, indicating its significance in Google's security bounty program (Chrome Release).