CVE-2024-4671

CRITICAL9.6

CISA KEV

Published 2024-05-14 · Updated 2026-06-17 · Source chrome-cve-admin@google.com

Summary

CVE-2024-4671 is a critical-severity (CVSS 9.6) vulnerability in Google Chromium. CISA added it to the Known Exploited Vulnerabilities catalog on May 13, 2024, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by June 3, 2024. CISA does not currently list it as used in ransomware campaigns. Google has 76 vulnerabilities in the KEV catalog, 0 of them linked to ransomware.

All 76 known-exploited Google vulnerabilities →

Description

Use after free in Visuals in Google Chrome prior to 124.0.6367.201 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

CWE-416CWE-416

CISA Known-Exploited Vulnerability

Product: Google — Chromium

Name: Google Chromium Visuals Use-After-Free Vulnerability

Date added: 2024-05-13 · Due: 2024-06-03

Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

References

View on NVD

More exploited Google vulnerabilities

Most recently added to CISA KEV

CVE-2026-111497
Brotli — Google Brotli Unchecked Return Value Vulnerability
added 2026-10-27
CVE-2026-58704
Pixel — Google Pixel Improper Authorization Vulnerability
added 2026-09-16
CVE-2026-87491
Chromium V8 — Google Chromium V8 Out of Bounds Write Vulnerability
added 2026-09-09
CVE-2026-85046
Chromium V8 — Google Chromium V8 Type Confusion Vulnerability
added 2026-09-04
CVE-2026-11645
Chromium V8 — Google Chromium V8 Out-of-Bounds Read and Write Vulnerability
added 2026-06-09
CVE-2026-5281
Dawn — Google Dawn Use-After-Free Vulnerability
added 2026-04-01

View all →

Related CVEs

Same severity, most recent

CVE-2026-18838
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information and modify API configurations due to improper authentication. Identity information supplied in requests is not sufficiently verified, which could allow a caller to impersonate another user.
2026-11-07 · score 9.4
CVE-2026-18836
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to server-side request forgery. The affected component can be made to send requests to unintended destinations and return the response to the attacker.
2026-11-07 · score 9.3
CVE-2026-18535
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are vulnerable to a Regular Expression Denial of Service (ReDoS) attack and to improper neutralisation of wildcard query operators.
2026-11-07 · score 9.6
CVE-2026-17410
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to access and modify other tenants' portal data due to improper neutralization of argument delimiters.
2026-11-07 · score 9.9
CVE-2026-17409
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to execute unauthorized administrative operations and obtain sensitive information due to improper handling of case sensitivity. Access controls are not applied consistently to all variations of a request, which could allow restricted operations to be reached.
2026-11-07 · score 9.4