CVE-2024-4331 is a High (CVSS 8.8) use after free in Picture in Picture in Google Chrome before 124.0.6367.118. A crafted HTML page could cause heap corruption. Update Chrome to 124.0.6367.118 or later, and for managed fleets confirm the update has reached every desktop.
What's affected
- Product: Google Chrome for desktop. The record also lists Fedora 38 and 39 as distributions that ship Chromium packages.
- Affected versions: before 124.0.6367.118.
- Fixed version: 124.0.6367.118, or .119 on Windows and Mac per the Chrome Releases post I read. The post says the Extended Stable channel moved to 124.0.6367.118 for Mac and Windows.
- Severity: Chrome's own rating is High, and NVD's CVSS is 8.8, High. These agree.
- Credit and timing: the Chrome post names the reporter and a report date of 2024-04-16. I leave the name out here.
- Exploitation: the record's KEV flag is false and the Chrome post does not say it is exploited.
How to check if you're exposed
Open chrome://version in the browser. The first line shows the version number. Anything below 124.0.6367.118 is affected. Chrome updates in the background and applies the change on restart, so a browser that has been open for days may be behind.
For fleets, pull Chrome version data from your endpoint management tool. On Fedora, check your packaged Chromium version with rpm -q chromium and read the Fedora announcement the record links.
Other Chromium based browsers take the fix on their own schedule, so check each vendor.
What to do now
- Update Chrome and restart it. Check chrome://version afterward.
- Use your management tool to list endpoints below 124.0.6367.118 and force an update.
- Update Chromium based browsers and embedded runtimes such as Electron apps once their vendors ship the fix.
- On Fedora, install the updated chromium package from the Fedora announcement.
- Add a recurring browser version check to your patch reports.
Why it matters
The record maps this to CWE-416, use after free. The browser frees a block of memory and later uses it again. An attacker who controls what lands in that block can corrupt memory, which in a browser can lead to code execution inside the renderer.
Chrome's April 30 2024 post says this update carried two security fixes, both rated High, and this was one of them. Browsers are patched often because every page a user opens is untrusted input.
Quick check
Which Chrome version fixes CVE-2024-4331?
124.0.6367.118 on Linux, and .118 or .119 on Windows and Mac, per the Chrome Releases post.
Do I need to restart Chrome?
Yes. The update downloads in the background but takes effect on restart.
Scan your own dependencies
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan checks a manifest against known advisories, and the Gold directory keeps this record's details in one place.
Sources
The NVD record for CVE-2024-4331 (published 2024-05-01) supplied the description, score and weakness data. Pages marked fetched were read for this post. The others are listed in the record and were not read.
Last reviewed: 19 October 2026.
