CVE-2024-2885: Google Chrome Use After Free Vulnerability

CVE-2024-2885 Overview

CVE-2024-2885 is a use-after-free vulnerability in the Dawn component of Google Chrome. Dawn is Chrome's WebGPU implementation, which exposes GPU hardware to web content through a JavaScript API. The flaw affects Chrome versions prior to 123.0.6312.86 and is classified under [CWE-416]. A remote attacker can exploit heap corruption by serving a crafted HTML page to a victim running a vulnerable Chrome build. Successful exploitation may lead to arbitrary code execution within the renderer process. Fedora 38, 39, and 40 builds shipping Chromium are also affected.

Critical Impact
Remote attackers can trigger heap corruption through a malicious web page, potentially leading to renderer code execution with high impact to confidentiality, integrity, and availability.

Affected Products

Google Chrome versions prior to 123.0.6312.86
Fedora 38, 39, and 40 (Chromium packages)
Chromium-based browsers integrating the vulnerable Dawn/WebGPU component

Discovery Timeline

2024-03-26 - CVE-2024-2885 published to NVD
2025-03-18 - Last updated in NVD database

Technical Details for CVE-2024-2885

Vulnerability Analysis

The vulnerability resides in Dawn, the cross-platform implementation of the WebGPU standard used by Chrome. WebGPU exposes low-level GPU functionality to web content, including buffer management, command encoding, and shader execution. A use-after-free condition in Dawn allows an attacker to reference memory that has already been released back to the heap allocator. When that freed memory is reallocated and repopulated with attacker-controlled data, subsequent dereferences operate on corrupted object state. This primitive enables heap corruption that can be shaped into arbitrary read, write, or control-flow hijack within the renderer process sandbox.

Root Cause

The root cause is improper lifetime management of a Dawn object accessible via the WebGPU API. The component releases an underlying allocation while one or more references remain reachable from JavaScript-driven GPU commands. Because WebGPU operations execute asynchronously and span multiple threads, ordering errors between object destruction and command submission create the window in which the freed memory is reused. The defect is tracked in the Chromium Issue Tracker.

Attack Vector

Exploitation requires a victim to visit a crafted HTML page in a vulnerable Chrome build with WebGPU enabled. The attacker delivers JavaScript that issues a specific sequence of WebGPU calls to trigger the dangling reference. The attacker then sprays the heap to control the contents of the reclaimed allocation. User interaction is limited to navigating to the malicious page, and no authentication is required. Successful renderer compromise typically serves as the first stage in a sandbox escape chain.

The vulnerability is described in prose only; no verified public proof-of-concept is available. See the Chrome Stable Channel Update for vendor details.

Detection Methods for CVE-2024-2885

Indicators of Compromise

Chrome renderer process crashes referencing Dawn, WebGPU, or dawn_native modules in crash reports
Outbound connections from browser processes to unfamiliar domains immediately after rendering attacker-controlled pages
Unexpected child processes spawned by chrome.exe following navigation events
Browser telemetry indicating WebGPU API usage on untrusted origins

Detection Strategies

Inventory Chrome versions across managed endpoints and flag any build below 123.0.6312.86
Monitor endpoint detection telemetry for browser process anomalies, including suspicious memory regions marked executable in renderer processes
Correlate web proxy logs with renderer crash signatures to identify exploitation attempts
Enable Chrome enterprise reporting to surface unexpected extension installs or policy changes following browsing sessions

Monitoring Recommendations

Forward Chrome crash dumps and chrome://crashes data to a central analytics pipeline for triage
Track DNS and HTTP telemetry for newly registered domains hosting WebGPU-heavy content delivered to internal users
Alert on post-exploitation behaviors such as credential file access or LSASS interaction originating from browser child processes
Apply MITRE ATT&CK technique T1189 (Drive-by Compromise) detections to web gateway and EDR data

How to Mitigate CVE-2024-2885

Immediate Actions Required

Update Google Chrome to version 123.0.6312.86 or later on all Windows, macOS, and Linux endpoints
Apply Fedora package updates for Chromium on Fedora 38, 39, and 40 hosts as referenced in the Fedora package announcement
Restart browser sessions after patching to ensure the vulnerable renderer code is unloaded
Audit Chromium-based browsers (Edge, Brave, Opera, Vivaldi) and apply vendor updates that incorporate the upstream Dawn fix

Patch Information

Google released the fix in the Stable Channel update for desktop on March 26, 2024, with versions 123.0.6312.86 for Linux and 123.0.6312.86/.87 for Windows and macOS. Fedora published corresponding Chromium package updates through standard dnf channels. Refer to the Chrome Stable Channel Update for release notes.

Workarounds

Disable WebGPU via the enterprise policy HardwareAccelerationModeEnabled=false or the chrome://flags/#enable-unsafe-webgpu flag where business requirements allow
Restrict browsing to trusted sites through web filtering until patches are deployed
Apply the Chrome URLBlocklist policy to block access to known malicious or untrusted origins serving WebGPU content
Educate users to avoid clicking untrusted links and to report unexpected browser crashes

bash

# Example: enforce Chrome auto-update and verify version on Linux endpoints
sudo apt-get update && sudo apt-get install --only-upgrade google-chrome-stable
google-chrome --version  # Confirm output reports 123.0.6312.86 or later

# Fedora
sudo dnf upgrade --refresh chromium