CVE-2024-4558: apple ipados Use After Free
CVSS: 9.6v3.1CriticalModified
AliasesUBUNTU-CVE-2024-4558DEBIAN-CVE-2024-4558CGA-jgvc-cgpx-w445CGA-m637-2f95-g697
Published 07-05-2024Last modified 04-11-2025
Vulnerability summary
CVE-2024-4558 is a critical (CVSS 9.6) Use After Free vulnerability in apple ipados. EPSS estimates a 1.53% chance of exploitation in the next 30 days, higher than 74.4% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
9.6/10
010
Critical · v3.1 (NVD)EPSS score
1.53%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1reference
Advisory lineage
Upstream 0 · Downstream 27 · Related 13DLA-3864-1DSA-5683-1DSA-5762-1MGASA-2024-0178MGASA-2025-0291OPENSUSE-SU-2024:13945-1OPENSUSE-SU-2024:13953-1OPENSUSE-SU-2024:14548-1RHSA-2024:8180RHSA-2024:8492RHSA-2024:8496RHSA-2024:9144RHSA-2024:9636RHSA-2024:9646RHSA-2024:9653RHSA-2024:9679RHSA-2024:9680RHSA-2025:10364SUSE-SU-2024:3005-1SUSE-SU-2024:3052-1SUSE-SU-2024:3091-1SUSE-SU-2024:3109-1SUSE-SU-2024:3751-1SUSE-SU-2024:3752-1SUSE-SU-2024:3869-1SUSE-SU-2024:3870-1USN-6996-1CGA-GJ74-3PQ2-4FF7
Timeline
- 07-05-2024PublishedVulnerability first disclosed.
- 04-11-2025Last modifiedVulnerability information updated.
Description
Use after free in ANGLE in Google Chrome prior to 124.0.6367.155 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS metrics
6 scores · 6 sources · 1 versionCritical 9.6Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:HSources6 sources · 7.5–9.6
- CVE.orgCNA7.5HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:HDiffers
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:HDiffers
- OSV · DebianEcosystem advisory · calculated9.6CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
- OSV · WolfiEcosystem advisory · calculated9.6CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
- OSV · ChainguardEcosystem advisory · calculated9.6CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
EPSS trend
Probability
1.53%
Chance of exploitation in the next 30 days
Percentile
74%
Versus all other CVEs
30-day change
0.00 pp
From 1.53% on 19-09-2026
19-09-202619-10-2026
EPSS score1.53%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (issues.chromium.org)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Ubuntu5 products
- qtwebkit-opensource-srcAll versions (No fix recorded)
- qtwebkit-sourceAll versions (No fix recorded)
- webkit2gtkAll versions (No fix recorded) | < 2.44.3-0ubuntu0.22.04.1 | < 2.44.3-0ubuntu0.24.04.1
- webkitgtkAll versions (No fix recorded)
- wpewebkitAll versions (No fix recorded)
Debian3 products
- chromium< 124.0.6367.155-1~deb12u1 | < 124.0.6367.155-1
- webkit2gtk< 2.44.3-1~deb12u1 | < 2.44.3-1
- wpewebkitAll versions (No fix recorded) | < 2.44.3-1
Chainguard1 product
- chromium< 124.0.6367.155-r0
Fedoraproject1 product
- fedoraEOL38 | 39 | 40
Google1 product
- chrome≥ 124.0.6367.155, < 124.0.6367.155 | < 124.0.6367.155
Wolfi1 product
- chromium< 124.0.6367.155-r0
7 vendors · 16 products
References
18 links- chromereleases.googleblog.com/2024/05/stable-channel-update-for-desktop_7.htmlREPORTAdvisoryRelease Notes
