CVE-2024-0222: Use-After-Free Vulnerability in ANGLE Component of Chromium-Based Browsers

Vulnerability Summary

• CVE ID: CVE-2024-0222​

• Severity: High (CVSS 3.1 Score: 8.8)​Tenable®+1CVE+1

• Attack Vector: Network​

• Privileges Required: None​Debian Security Tracker+1Microsoft Security Response Center+1

• User Interaction: Required​CVE+3Microsoft Security Response Center+3Microsoft Security Response Center+3

• Impact: Potential heap corruption leading to remote code execution​

Affected Products

This vulnerability affects the ANGLE (Almost Native Graphics Layer Engine) component in Chromium-based browsers.​Ubuntu

How the Exploit Works

The vulnerability arises from a use-after-free condition in the ANGLE component, which is responsible for translating OpenGL ES API calls to other graphics APIs like Direct3D. An attacker who has already compromised the renderer process can exploit this flaw by crafting a malicious HTML page. When a user visits this page, the attacker can potentially trigger heap corruption, leading to arbitrary code execution within the browser’s sandboxed environment. ​Tenable®+5Recorded Future+5Rapid7+5Tenable®Ubuntu+3Debian Security Tracker+3Rapid7+3CVE

Conceptual Example Code

While specific exploit code is not publicly available, a conceptual approach involves:​

1. Crafting a malicious HTML page that performs operations leading to the use-after-free condition in the ANGLE component.​Rapid7+2Ubuntu+2Debian Security Tracker+2

2. Hosting this page on a server controlled by the attacker.​

3. Tricking a user into visiting the malicious page, thereby triggering the vulnerability.​

Potential Risks

• Execution of arbitrary code within the browser context​

• Potential sandbox escape leading to broader system compromise​

• Unauthorized access to sensitive information​

• Installation of malicious software​

Mitigation Recommendations

• Update Browsers: Ensure that Google Chrome is updated to version 120.0.6099.199 or later, and Microsoft Edge is updated to version 120.0.2210.121 or later.​CVE+5Ubuntu+5Debian Security Tracker+5

• Enable Automatic Updates: Configure browsers to update automatically to receive security patches promptly.​

• Educate Users: Inform users about the risks of visiting untrusted websites and encourage cautious browsing habits.​

• Implement Security Tools: Use security solutions that can detect and block malicious web content.​

Conclusion

CVE-2024-0222 is a high-severity vulnerability in the ANGLE component of Chromium-based browsers, potentially allowing attackers to execute arbitrary code through crafted HTML pages. Promptly updating affected browsers and maintaining vigilant browsing practices are essential to mitigate this threat.​

References

• NVD – CVE-2024-0222

• Microsoft Security Response Center

• Debian Security Tracker

• Rapid7 Vulnerability Database

• Ubuntu Security Notice