CVE-2024-4058 is a high severity type confusion in ANGLE, the graphics layer inside Google Chrome. NVD scores it 8.8, while Chromium rated it Critical. Versions before 124.0.6367.78 are affected. Update Chrome to 124.0.6367.78 or later and restart the browser to apply the fix.
What's affected
The record lists Google Chrome prior to 124.0.6367.78. It also lists Fedora 40 because Fedora ships Chromium builds in its package repositories. A remote attacker could cause heap corruption through a crafted HTML page, and the user has to visit the page. The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
The two sources disagree on severity, and both are worth knowing. The record says Chromium rated it Critical using its own scale. NVD scores it 8.8, which is High on the CVSS scale. Neither is wrong, because they use different rating systems. Use the stricter one for patch timing.
The fixed version is 124.0.6367.78, taken from the record. The advisory is the Chrome Releases post for the 24 April 2024 stable channel update, and we did not fetch it for this draft.
Weakness class: CWE-843 (type confusion).
How to check if you're exposed
In Chrome, open the three dot menu, then Help, then About Google Chrome. The page shows the version and starts an update check. If the version is below 124.0.6367.78 you are exposed.
On Linux you can also read it from a terminal:
google-chrome --version
chromium --version
On Fedora 40, check the package your system uses and apply the update that its security announcement lists.
What to do now
- Update Chrome on every desktop to 124.0.6367.78 or later, then relaunch the browser. Updates do not apply until the browser restarts.
- Push the same update through your device management tool for managed fleets.
- On Fedora 40, install the Chromium update from the distribution once available and confirm with the version command.
- Remember that other Chromium based browsers need their own update. Check Edge, Brave and others you allow.
- Add a browser version check to your regular compliance reporting.
Why it matters
Type confusion happens when code treats a piece of memory as one type of object when it is really another. That mismatch lets the program read or write memory in ways its authors did not plan, which in a browser can lead to heap corruption and, in the worst case, code running with the browser's rights.
ANGLE translates web graphics calls to the system graphics library, so a page can reach it just by being loaded. That is why the attack needs only a crafted page and a click. The record does not mark this as exploited in the wild and the KEV flag is false, but browser flaws are patched quickly for a reason.
Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan and a Gold directory of vulnerability pages for software you already track.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is Chrome 124.0.6367.78 the fix?
Yes. The record says versions prior to 124.0.6367.78 are affected, so that version or later has the fix.
Is it exploited in the wild?
The record does not say so and the KEV flag is false.
Sources
- NVD record data for CVE-2024-4058
- chromereleases.googleblog.com reference
- issues.chromium.org reference
- lists.fedoraproject.org reference
These are the references listed in the record. We did not fetch them for this draft, so check the Chrome Releases post for the full list of fixes.
Last reviewed: 19 October 2026.
