CVE-2024-10487: Google Chrome Dawn RCE Vulnerability

CVE-2024-10487 Overview

CVE-2024-10487 is an out-of-bounds write vulnerability [CWE-787] in the Dawn component of Google Chrome. Dawn is Chrome's open-source implementation of the WebGPU standard, which exposes GPU functionality to web content. Versions of Google Chrome prior to 130.0.6723.92 are affected. A remote attacker can trigger out-of-bounds memory access by serving a crafted HTML page to a victim. Chromium engineers classified the security severity as Critical, while the public CVSS score lists it as High.

Critical Impact
A remote attacker can perform out-of-bounds memory writes in the Chrome renderer via a crafted HTML page, potentially leading to memory corruption and arbitrary code execution in the renderer process.

Affected Products

Google Chrome (Desktop) versions prior to 130.0.6723.92
Chromium-based browsers embedding the vulnerable Dawn/WebGPU implementation
Operating systems running affected Chrome builds (Windows, macOS, Linux)

Discovery Timeline

2024-10-29 - Google releases stable channel update fixing the issue (Chrome Releases)
2024-10-29 - CVE-2024-10487 published to the National Vulnerability Database
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2024-10487

Vulnerability Analysis

The flaw resides in Dawn, the cross-platform WebGPU implementation shipped with Chrome. Dawn translates WebGPU API calls from JavaScript into native graphics commands on Direct3D, Metal, or Vulkan backends. An out-of-bounds write [CWE-787] occurs when Dawn writes data past the end of an allocated buffer while processing attacker-controlled GPU command input. Memory corruption inside the GPU process or renderer can be chained with sandbox escapes to achieve broader compromise. The Chromium issue tracker entry 375123371 restricts deeper technical detail under Google's standard disclosure policy.

Root Cause

The root cause is missing or incorrect bounds validation on a memory write path in Dawn's WebGPU command handling. When the browser processes crafted WebGPU commands or resource descriptors from JavaScript, Dawn writes beyond the bounds of the intended target buffer. CWE-787 vulnerabilities of this nature commonly enable heap metadata corruption, adjacent object overwrite, or function pointer overwrite.

Attack Vector

Exploitation is network-based and requires user interaction. A victim must visit a malicious or compromised web page that loads JavaScript invoking the WebGPU API with attacker-supplied parameters. No authentication is required. Standard delivery techniques include phishing links, watering-hole attacks, and malicious advertisements served through ad networks.

No public proof-of-concept code or exploit module has been published for this issue. Technical details remain restricted in the Chromium Issue Tracker.

Detection Methods for CVE-2024-10487

Indicators of Compromise

Unexpected Chrome renderer or GPU process crashes referencing Dawn or WebGPU modules in crash dumps
Browser sessions visiting unfamiliar domains immediately preceding renderer or GPU process termination
Child processes spawned by chrome.exe that do not match standard Chrome process lineage

Detection Strategies

Inventory installed Chrome versions across the fleet and flag any build below 130.0.6723.92
Monitor endpoint telemetry for abnormal memory access violations or access-violation exceptions in Chrome GPU and renderer processes
Correlate web proxy logs with endpoint crash events to identify pages triggering renderer faults

Monitoring Recommendations

Track Chrome version compliance through endpoint management or EDR software inventory queries
Alert on Chrome processes performing post-exploitation behaviors such as credential file access, LSASS handle requests, or unusual outbound connections
Forward browser crash reports and WER/CrashPad data to centralized logging for retrospective analysis

How to Mitigate CVE-2024-10487

Immediate Actions Required

Update Google Chrome to version 130.0.6723.92 or later on all Windows, macOS, and Linux endpoints
Restart Chrome after the update so the patched binaries are loaded into memory
Audit Chromium-based browsers and embedded WebViews to confirm they incorporate the fixed Dawn revision

Patch Information

Google addressed the vulnerability in the Chrome Stable channel update released on October 29, 2024. The fixed build is 130.0.6723.92 for Linux and 130.0.6723.91/92 for Windows and macOS. Refer to the Chrome Stable Channel Update for Desktop for full release notes.

Workarounds

Disable WebGPU until patching is complete by launching Chrome with the --disable-features=WebGPU flag or via enterprise policy
Restrict access to untrusted websites using enterprise web filtering or DNS-based controls
Enforce automatic Chrome updates through the ChromeBrowserUpdater policy on managed endpoints

bash

# Configuration example: enforce Chrome auto-update and disable WebGPU on Linux
# /etc/opt/chrome/policies/managed/cve-2024-10487.json
{
  "DisabledSchemes": [],
  "DefaultBrowserSettingEnabled": true,
  "BrowserSignin": 1,
  "ComponentUpdatesEnabled": true,
  "DisableScreenshots": false,
  "ExtensionInstallBlocklist": [],
  "URLBlocklist": [],
  "DisabledFeatures": ["WebGPU"]
}