CVE-2024-1673 is a high severity flaw in Google Chrome, a use after free in Accessibility that a remote attacker can reach through specific UI gestures after the renderer has been compromised. Chrome versions before 122.0.6261.57 are affected. The fix is to update Chrome to 122.0.6261.57 or later and restart the browser.
What's affected
The record says Google Chrome prior to 122.0.6261.57 is affected. The fix shipped in the stable channel update of 20 February 2024, which Google's release notes describe, including an Extended Stable build of 122.0.6261.57 for Windows and Mac. The NVD score is 8.8 (high) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
The Accessibility component handles features used by assistive technology. The record says exploitation needs an attacker who has already compromised the renderer process and uses specific UI gestures. The weakness is CWE-416 (use after free).
Severity differs between sources. The NVD record scores it 8.8 (high) while the Chromium security severity in the description and the Chrome release notes is Medium. Both can be true, since the Chromium rating reflects the need for a prior compromise.
Chromium based browsers such as Edge, Brave and others take the Chromium fix on their own schedule, so check each one. Linux distributions, including Fedora 38 and 39 listed in the record, ship their own packages.
How to check if you're exposed
Open the About page of the browser and read the version number.
chrome://version
Anything lower than 122.0.6261.57 is affected. On managed fleets, query your endpoint inventory for the Chrome version, and check every Chromium based browser separately. On Linux, check the package manager.
google-chrome --version
What to do now
- Update Chrome to 122.0.6261.57 or later and restart the browser, since the update applies on relaunch.
- Update other Chromium based browsers and embedded browser components as their vendors publish fixes.
- On managed fleets, force the update through policy and report on stragglers.
- Enable automatic updates and check that users are not postponing relaunch for days.
- Update desktop apps built on Chromium that bundle their own engine, as they do not follow the browser update.
Why it matters
Browsers are the most exposed software on most machines, since they run content from anywhere. A use after free in a privileged component is most useful as a second stage after another bug has given the attacker a foothold in the sandboxed renderer. That is why Chromium rates it lower than a bug reachable directly from a web page.
The record's KEV flag is false for this CVE, and the release notes we read do not report exploitation. Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan can show whether a component tied to this CVE appears in your dependency manifests. The Gold directory keeps the record, severity and references in one place, and reachability analysis helps you separate code paths that can actually be hit from packages that are merely installed. Chromium issue tracker entries may stay restricted until most users have updated.
Quick check
Is it enough to update Chrome only?
No. Other Chromium based browsers and apps with a bundled engine need their own updates. Check each one.
Sources
Last reviewed: 19 October 2026.
