CVE-2024-1670 is a high severity flaw in Google Chrome, a use after free in Mojo that a remote attacker can reach through a crafted HTML page. Chrome versions before 122.0.6261.57 are affected. The fix is to update Chrome to 122.0.6261.57 or later and restart the browser.
What's affected
The record says Google Chrome prior to 122.0.6261.57 is affected. The fix shipped in the stable channel update of 20 February 2024, which Google's release notes describe, including an Extended Stable build of 122.0.6261.57 for Windows and Mac. The NVD score is 8.8 (high) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
Mojo is the inter process communication layer Chrome uses between its processes. The Chrome release notes list this as a High severity fix reported by Cassidy Kim on 6 December 2023. The weakness is CWE-416 (use after free).
Chromium based browsers such as Edge, Brave and others take the Chromium fix on their own schedule, so check each one. Linux distributions, including Fedora 38 and 39 listed in the record, ship their own packages.
How to check if you're exposed
Open the About page of the browser and read the version number.
chrome://version
Anything lower than 122.0.6261.57 is affected. On managed fleets, query your endpoint inventory for the Chrome version, and check every Chromium based browser separately. On Linux, check the package manager.
google-chrome --version
What to do now
- Update Chrome to 122.0.6261.57 or later and restart the browser, since the update applies on relaunch.
- Update other Chromium based browsers and embedded browser components as their vendors publish fixes.
- On managed fleets, force the update through policy and report on stragglers.
- Enable automatic updates and check that users are not postponing relaunch for days.
- Update desktop apps built on Chromium that bundle their own engine, as they do not follow the browser update.
Why it matters
Browsers are the most exposed software on most machines, since they run content from anywhere. A use after free happens when code keeps using memory after it has been released, so an attacker who controls what is placed there may corrupt the heap.
The record's KEV flag is false for this CVE, and the release notes we read do not report exploitation. Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan can show whether a component tied to this CVE appears in your dependency manifests. The Gold directory keeps the record, severity and references in one place, and reachability analysis helps you separate code paths that can actually be hit from packages that are merely installed. Chromium issue tracker entries may stay restricted until most users have updated.
Quick check
Is it enough to update Chrome only?
No. Other Chromium based browsers and apps with a bundled engine need their own updates. Check each one.
Sources
Last reviewed: 19 October 2026.
