# CVE-2024-4331: Chromium: CVE-2024-4331 Use after free in Picture In Picture

CVE-2024-4331 is fixed in 5 products on 2 platforms, first by DEBIAN-CVE-2024-4331, released May 1, 2024. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2024-4331
- Priority: High
- CVSS: 8.8 (high)
- EPSS: 0.0122
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: May 1, 2024
- Weakness: CWE-416: Use After Free
- Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-4331

## Description

<p>This CVE was assigned by Chrome.  Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see <a href="https://chromereleases.googleblog.com/2024">Google Chrome Releases</a> for more information.</p>

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Windows apps | Microsoft Edge | 124.0.2478.80 | [Microsoft Edge 124.0.2478.80](https://patchblox.com/security/data/fix/windows-app/microsoft.edge-124.0.2478.80.md) | May 2, 2024 |
| Windows apps | Microsoft Edge Beta | 127.0.2651.8 | [Microsoft Edge Beta 127.0.2651.8](https://patchblox.com/security/data/fix/windows-app/microsoft.edge.beta-127.0.2651.8.md) | Jun 21, 2024 |
| Windows apps | Microsoft Edge Dev | 127.0.2651.8 | [Microsoft Edge Dev 127.0.2651.8](https://patchblox.com/security/data/fix/windows-app/microsoft.edge.dev-127.0.2651.8.md) | Jun 21, 2024 |
| Windows apps | Microsoft Edge WebView2 Runtime | 125.0.2535.67 | [Microsoft Edge WebView2 Runtime 125.0.2535.67](https://patchblox.com/security/data/fix/windows-app/microsoft.edgewebview2runtime-125.0.2535.67.md) | May 24, 2024 |
| Linux | chromium Debian 12.15 (bookworm) | 124.0.6367.118-1~deb12u1 | [DSA-5676-1](https://patchblox.com/security/data/fix/linux/dsa-5676-1.md) | May 2, 2024 |
| Linux | chromium Debian 13.5 (trixie) | 124.0.6367.118-1 | [DEBIAN-CVE-2024-4331](https://patchblox.com/security/data/fix/linux/debian-cve-2024-4331.md) | May 1, 2024 |
| Linux | chromium Debian 14 | 124.0.6367.118-1 | [DEBIAN-CVE-2024-4331](https://patchblox.com/security/data/fix/linux/debian-cve-2024-4331.md) | May 1, 2024 |

---

Data as of 2026-11-07T12:40:37Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo