CVE-2024-9954
Published: 15 October 2024
Summary
CVE-2024-9954 is a high-severity Use After Free (CWE-416) vulnerability in Google Chrome. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Drive-by Compromise (T1189); ranked in the top 8.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
This vulnerability is AI-related — categorised as Other Platforms; in the Other ATLAS/OWASP Terms risk domain.
Deeper analysis
CVE-2024-9954 is a use-after-free vulnerability in the AI component of Google Chrome versions prior to 130.0.6723.58. The flaw, tracked under CWE-416, can result in heap corruption when processing specially crafted input and carries a CVSS 3.1 base score of 8.8.
A remote attacker can exploit the issue by serving a malicious HTML page to a victim; successful exploitation requires the user to visit the page and may allow arbitrary code execution or other impacts within the browser process.
The stable-channel update published on 15 October 2024 states that upgrading to Chrome 130.0.6723.58 or later resolves the vulnerability, and the underlying issue is documented in the Chromium bug tracker at issues.chromium.org.
EPSS for the CVE reached a peak of 0.0907 after disclosure, indicating a measurable increase in exploitation interest from its current value of 0.0654.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-50236
Vulnerability details
Use after free in AI in Google Chrome prior to 130.0.6723.58 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- CWE(s)
AI Security AnalysisAI
- AI Category
- Other Platforms
- Risk Domain
- Other ATLAS/OWASP Terms
- OWASP Top 10 for LLMs 2025
- None mapped
- Classification Reason
- The vulnerability is a use-after-free in the 'AI' component of Google Chrome, a web browser platform integrating AI features (likely on-device ML or web-triggered AI inference), which fits 'Other Platforms' as it is not a dedicated deep learning framework, library, or specific AI subdomain like NLP or computer vision.
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Use-after-free vulnerability in Chrome's AI component enables remote heap corruption via crafted HTML page, facilitating drive-by compromise (T1189) and exploitation for client execution (T1203).
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Use-after-free exploits that achieve arbitrary code execution are blocked or significantly hardened by non-executable pages and ASLR.