CVE-2024-4060: Google Chrome Use-After-Free Vulnerability

CVE-2024-4060 Overview

CVE-2024-4060 is a use-after-free vulnerability in Dawn, the WebGPU implementation used by Google Chrome. The flaw affects Chrome versions prior to 124.0.6367.78 and allows a remote attacker to trigger heap corruption through a crafted HTML page. Successful exploitation requires the victim to load attacker-controlled web content, satisfying the user interaction requirement. The Chromium project rated the security severity as High, while the NVD scoring reflects an availability-only impact. The issue is tracked under CWE-416 and was patched in the stable channel update for desktop released by Google in April 2024.

Critical Impact
A remote attacker can exploit heap corruption in the GPU process by enticing a user to visit a malicious page, potentially leading to renderer instability or further memory-safety exploitation.

Affected Products

Google Chrome versions prior to 124.0.6367.78
Fedora Project Fedora 40
Chromium-based browsers shipping the vulnerable Dawn component

Discovery Timeline

2024-05-01 - CVE-2024-4060 published to NVD
2025-11-04 - Last updated in NVD database

Technical Details for CVE-2024-4060

Vulnerability Analysis

The defect resides in Dawn, the cross-platform implementation of the WebGPU standard used by Chrome to expose GPU acceleration to web content. Dawn manages GPU resources such as buffers, textures, and command encoders on behalf of renderer processes. A use-after-free condition occurs when one of these objects is released while another code path still holds a reference to it. Subsequent access dereferences freed memory, producing heap corruption that an attacker can shape through controlled allocations from JavaScript or WebGPU API calls.

The attack requires only that a user open a crafted HTML page, which makes drive-by exploitation through malicious advertisements, phishing links, or compromised websites realistic. Because Dawn runs inside the GPU process, successful corruption primarily threatens that process and the renderer that issued the calls. Memory-safety bugs in Chrome's GPU pipeline have historically been chained with sandbox escapes to achieve broader compromise.

Root Cause

The root cause is improper lifetime management of a GPU resource object inside Dawn, classified as [CWE-416] Use After Free. Reference tracking between the renderer-side WebGPU wrappers and the underlying Dawn objects failed to keep the backing allocation alive across all reachable code paths. Details of the specific object and call sequence are tracked in the Chromium Issue Report.

Attack Vector

Exploitation is performed over the network with low complexity and requires user interaction. An attacker hosts a page that issues a specific sequence of WebGPU operations to free a Dawn-managed object and then reuses it. Spraying the freed slot with attacker-controlled data sets up the heap corruption that follows. Public exploit code for CVE-2024-4060 is not currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

No verified proof-of-concept code is available. See the Google Chrome Update Announcement for vendor-provided context.

Detection Methods for CVE-2024-4060

Indicators of Compromise

Unexpected crashes of the Chrome GPU process with heap corruption signatures around Dawn or WebGPU symbols.
Renderer or GPU process termination shortly after navigation to an untrusted site that uses WebGPU features.
Outbound connections from Chrome child processes to unknown infrastructure following a crash event.

Detection Strategies

Inventory installed Chrome versions across endpoints and flag any build below 124.0.6367.78 as vulnerable.
Correlate browser crash telemetry with navigation history to identify users who visited pages triggering GPU-process faults.
Monitor for child-process anomalies originating from chrome.exe such as unexpected process creation or memory regions marked executable.

Monitoring Recommendations

Forward browser crash dumps and Windows Error Reporting events to a central log store for retrospective analysis.
Track WebGPU adoption in the environment through proxy logs and enterprise browser policies to scope exposure.
Alert on Chrome processes loading uncommon DLLs or spawning shells, which would indicate post-exploitation activity after a sandbox escape attempt.

How to Mitigate CVE-2024-4060

Immediate Actions Required

Update Google Chrome to 124.0.6367.78 or later on all managed endpoints, including kiosks and virtual desktops.
Apply the corresponding Fedora 40 package updates referenced in the Fedora Project advisories.
Restart Chrome after the update to ensure the patched binaries are loaded into memory.

Patch Information

Google addressed the vulnerability in the Chrome stable channel update released on April 24, 2024, fixed in version 124.0.6367.78 and later. Linux distributions shipped corresponding rebuilds; see the Fedora Package Announcement for Fedora 40 update details. Chromium downstream projects should rebase to the patched Dawn revision referenced in the Chromium Issue Report.

Workarounds

Disable WebGPU via enterprise policy or the chrome://flags/#enable-unsafe-webgpu setting until patching is complete.
Restrict browsing to trusted sites through proxy or DNS filtering to reduce exposure to crafted HTML pages.
Enforce automatic Chrome updates through ChromeAutoUpdateDisabled=false group policy to prevent version drift.

bash

# Verify installed Chrome version on Linux
google-chrome --version

# Update Chrome on Fedora 40
sudo dnf update -y google-chrome-stable

# Enterprise policy snippet (Windows registry) to enforce auto-update
reg add "HKLM\Software\Policies\Google\Update" /v AutoUpdateCheckPeriodMinutes /t REG_DWORD /d 60 /f