CVE-2024-0225: Google Chrome Use After Free Vulnerability

CVE-2024-0225 Overview

CVE-2024-0225 is a use-after-free vulnerability in the WebGPU component of Google Chrome prior to version 120.0.6099.199. A remote attacker can exploit heap corruption by serving a crafted HTML page to a target user. Chromium rates the security severity as High, and the CVSS 3.1 base score is 8.8. The flaw requires user interaction, meaning the victim must visit an attacker-controlled or compromised web page. Successful exploitation can lead to arbitrary code execution within the renderer process, providing a foothold for further sandbox escape attempts. The vulnerability is tracked under [CWE-416: Use After Free].

Critical Impact
Remote attackers can trigger heap corruption in the Chrome renderer through a crafted HTML page, enabling potential code execution on the victim system.

Affected Products

Google Chrome versions prior to 120.0.6099.199
Fedora 38
Fedora 39

Discovery Timeline

2024-01-04 - CVE-2024-0225 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-0225

Vulnerability Analysis

The vulnerability resides in Chrome's WebGPU implementation, which exposes GPU compute and rendering capabilities to web content through JavaScript. WebGPU manages a complex graph of GPU resources, including buffers, textures, pipelines, and command encoders, each with distinct lifetime semantics. A use-after-free condition occurs when one of these objects is released while a reference to it remains accessible to renderer code.

When the freed memory is reallocated for a different object, subsequent access through the stale reference corrupts the heap. Attackers shape the heap through controlled JavaScript allocations to place attacker-influenced data at the freed location. This primitive enables overwriting of object metadata or function pointers used by V8 or the GPU command processor.

Root Cause

The root cause is improper lifetime management of WebGPU resources mapped between the renderer and the GPU process. Reference counting or ownership tracking fails to account for asynchronous operations that retain dangling pointers after an object is destroyed. CWE-416 categorizes this class of defect.

Attack Vector

Exploitation requires the victim to load a malicious HTML page that invokes WebGPU APIs in a sequence designed to free and reuse a target object. No authentication is required, and the attack proceeds entirely from the network. Because WebGPU runs inside the renderer sandbox, immediate impact is limited to the renderer process. Chained with a sandbox escape, the flaw can enable full host compromise.

No public proof-of-concept exploit is available, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog. Technical details remain restricted in the Chromium bug tracker entry 1506923.

Detection Methods for CVE-2024-0225

Indicators of Compromise

Chrome renderer process crashes with heap corruption signatures referencing WebGPU components such as dawn or gpu::CommandBuffer.
Unexpected child process spawns from chrome.exe shortly after browsing untrusted sites that invoke WebGPU.
Outbound connections to unfamiliar domains immediately following navigation to a page that loads GPU shader content.

Detection Strategies

Inventory installed Chrome versions across endpoints and flag any build earlier than 120.0.6099.199.
Monitor browser telemetry and crash reports for renderer terminations involving WebGPU code paths.
Correlate web proxy logs with endpoint process events to identify suspicious post-navigation activity originating from the browser.

Monitoring Recommendations

Enable centralized collection of Chrome crash dumps and forward them to a SIEM for pattern analysis.
Alert on Chrome subprocess execution chains that deviate from baseline behavior, such as shell or scripting host spawns.
Track Fedora package update status for chromium and google-chrome-stable to confirm patch deployment across Linux workstations.

How to Mitigate CVE-2024-0225

Immediate Actions Required

Update Google Chrome to version 120.0.6099.199 or later on all managed endpoints.
Apply Fedora package updates referenced in the Fedora package announcement for Fedora 38 and 39.
Restart browser sessions after patching to ensure the vulnerable renderer code is unloaded.

Patch Information

Google addressed the issue in the Stable Channel update documented in the Google Chrome update announcement. Gentoo users should apply the fix described in Gentoo GLSA 202401-34. Chromium-based browsers that incorporate the upstream fix should also be updated to the corresponding patched build.

Workarounds

Disable WebGPU through the chrome://flags/#enable-unsafe-webgpu setting until patches are deployed.
Restrict access to untrusted websites through enterprise web filtering policies.
Enforce automatic Chrome updates through Group Policy or MDM to reduce exposure windows on future browser vulnerabilities.

bash

# Verify installed Chrome version on Linux
google-chrome --version

# Update Chrome on Fedora
sudo dnf update google-chrome-stable

# Update Chromium on Fedora
sudo dnf update chromium