CVE-2024-2176: High Use After Free in Chrome FedCM

CVE-2024-2176 is a high severity flaw in the FedCM component of Google Chrome, scored CVSS 8.8. A crafted HTML page can trigger it. Google fixed it in Chrome 122.0.6261.111 on Linux and 122.0.6261.111 or .112 on Windows and Mac, so update and restart the browser.

What's affected

The record says Google Chrome prior to 122.0.6261.111 is affected. Google's Stable Channel Update of 5 March 2024 moved the Stable channel to 122.0.6261.111 or .112 for Windows and Mac and 122.0.6261.111 for Linux, with a roll out over the coming days and weeks. The Extended Stable channel went to 122.0.6261.112 for Windows and Mac. The same update carried three security fixes in total.

Weakness: a use after free, which is CWE-416, in FedCM, the browser feature for federated sign in. Chromium rates the bug High, and NVD scores it 8.8 with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. That means a network attack of low complexity that needs no privileges but does need the user to visit a page. It was published on 2024-03-06.

The record also lists Fedora 40, since Fedora packages Chromium. Other browsers built on Chromium, and applications that embed it, take the fix on their own schedule, so check each vendor's notes rather than assuming they match Chrome's version.

Google lists this fix as reported anonymously, and the update carried three security fixes in total.

How to check if you're exposed

In Chrome, open the address chrome://version in a tab and read the first line. On the command line:

google-chrome --version
chromium --version

On Windows, you can read the version of the installed browser from the About Chrome page under the Help menu. The page also triggers an update check. Any version below 122.0.6261.111 is affected.

In a managed fleet, use your device management tool to report the browser version, and check for machines that have not restarted since the update was downloaded. Chrome downloads fixes in the background but the old version keeps running until the browser restarts.

Do not forget other places that run Chromium. Electron applications, kiosks, embedded browsers and test machines often lag behind. Ask each vendor which Chromium version they ship.

For your own software projects, the free in-browser dependency scan at gold.safeguard.sh/scan can flag packages that bundle a Chromium build.

What to do now

1. Update Chrome to 122.0.6261.111 or later (or the newer release on your channel) and restart the browser.
2. Use your management tool to confirm every machine reports a fixed version, not just that the update was downloaded.
3. For Chromium based browsers and Electron applications, check the vendor notes for the Chromium version they ship, and update them.
4. For Linux distributions that package Chromium, apply the distribution update. Fedora 40 is named in the record.
5. In the meantime, avoid opening links from untrusted sources on machines that have not updated.
6. Keep automatic browser updates on, and make sure users restart the browser when prompted.

Why it matters

Browser engines parse untrusted content all day, so memory safety bugs in them are a steady source of fixes. A use after free, which is cwe-416, in fedcm, the browser feature for federated sign in here. The bug lives in the browser's own code, which means the only reliable answer is the update, not a configuration change.

The CVSS vector needs the user to load a crafted page, so the risk grows with how much of your staff reads links from outside. CVE-2024-2176 is not on the CISA Known Exploited Vulnerabilities list, and none of the sources we read report exploitation in the wild. Browser fixes tend to be rolled out gradually, so confirm that your fleet has the fix rather than assuming it.

Quick check

Sources

• Chrome Releases, Stable Channel Update for Desktop
• Gold entry for CVE-2024-2176
• The Chromium issue tracker entry and the Fedora announcement are referenced by the record but were not retrieved.

Last reviewed: 19 October 2026.