CVE-2024-4368: Google Chrome Use After Free Vulnerability

CVE-2024-4368 Overview

CVE-2024-4368 is a use-after-free vulnerability in the Dawn component of Google Chrome prior to version 124.0.6367.118. Dawn is Chrome's implementation of the WebGPU standard, which provides high-performance GPU access to web applications. This memory corruption flaw allows a remote attacker to potentially exploit heap corruption via a crafted HTML page, enabling arbitrary code execution within the browser context.

Critical Impact

Remote attackers can exploit this use-after-free vulnerability to achieve heap corruption and potentially execute arbitrary code by enticing users to visit a malicious webpage, compromising system confidentiality, integrity, and availability.

Affected Products

• Google Chrome prior to version 124.0.6367.118
• Fedora 38, 39, and 40 (bundled Chromium packages)
• Chromium-based browsers using the affected Dawn component

Discovery Timeline

• 2024-05-01 - CVE-2024-4368 published to NVD
• 2025-03-13 - Last updated in NVD database

Technical Details for CVE-2024-4368

Vulnerability Analysis

This vulnerability is classified as CWE-416 (Use After Free), a memory corruption issue where an application continues to use a pointer after the memory it references has been deallocated. In the context of Chrome's Dawn WebGPU implementation, the flaw allows attackers to manipulate memory in a way that can lead to heap corruption. When a user visits a specially crafted HTML page containing malicious WebGPU calls, the browser may access freed memory, creating an opportunity for the attacker to overwrite critical data structures or inject executable code.

The vulnerability requires user interaction—specifically, the victim must navigate to an attacker-controlled webpage. Once exploited, the attacker gains the ability to compromise the confidentiality, integrity, and availability of the user's system within the browser's security context.

Root Cause

The root cause stems from improper memory management within the Dawn WebGPU component. During certain GPU rendering operations, memory objects are freed prematurely while references to those objects remain active. When subsequent code paths attempt to access these dangling references, the freed memory may have been reallocated for other purposes, leading to heap corruption. This type of vulnerability often occurs in complex rendering pipelines where object lifetimes are difficult to track across asynchronous GPU operations.

Attack Vector

The attack is network-based and requires social engineering to lure victims to a malicious webpage. The attacker constructs an HTML page with JavaScript that triggers specific WebGPU Dawn API calls in a particular sequence designed to exploit the use-after-free condition. The attack does not require any special privileges or authentication.

The exploitation flow typically involves:

1. The victim browses to an attacker-controlled or compromised website
2. Malicious JavaScript initiates WebGPU operations through the Dawn API
3. The crafted sequence triggers memory deallocation followed by a stale reference access
4. The attacker-controlled data overwrites the freed memory region
5. Upon the next access to the dangling pointer, the attacker achieves code execution or information disclosure

Technical details are available in the Chromium Issue Tracker Entry.

Detection Methods for CVE-2024-4368

Indicators of Compromise

• Unusual WebGPU API usage patterns in browser process memory
• Chrome renderer process crashes related to Dawn or GPU components
• Anomalous JavaScript execution attempting rapid GPU resource allocation/deallocation
• Heap corruption artifacts in Chrome crash dumps

Detection Strategies

• Monitor Chrome browser version across enterprise endpoints to identify instances running versions prior to 124.0.6367.118
• Deploy endpoint detection rules to identify suspicious WebGPU-related crashes or memory access violations
• Implement network monitoring for known malicious domains distributing WebGPU exploits
• Utilize Chrome's built-in crash reporting to identify potential exploitation attempts

Monitoring Recommendations

• Enable and centrally collect Chrome crash reports for analysis of Dawn/WebGPU-related failures
• Configure SentinelOne agents to monitor browser process behavior for memory corruption indicators
• Establish baseline WebGPU usage patterns to detect anomalous GPU API activity
• Review browser extension activity that may interact with WebGPU functionality

How to Mitigate CVE-2024-4368

Immediate Actions Required

• Update Google Chrome to version 124.0.6367.118 or later immediately
• For Fedora systems, apply the latest Chromium package updates from official repositories
• Enable automatic browser updates across all managed endpoints
• Instruct users to restart their browsers after updates are applied to ensure patches take effect

Patch Information

Google addressed this vulnerability in the Chrome Stable Channel update released on April 30, 2024. The fix is included in Chrome version 124.0.6367.118 and all subsequent releases. Full details are available in the Google Chrome Stable Update announcement.

Fedora users should apply updates through their package manager. Security advisories have been issued for Fedora 38, 39, and 40 with patched Chromium packages available in the official repositories.

Workarounds

• Temporarily disable WebGPU functionality by launching Chrome with the --disable-webgpu flag if patching is not immediately possible
• Implement web filtering to block access to untrusted or suspicious websites
• Consider using Chrome enterprise policies to restrict WebGPU access until patches can be applied
• Deploy browser isolation solutions for high-risk users who cannot immediately update

# Launch Chrome with WebGPU disabled as temporary workaround
google-chrome --disable-webgpu

# Verify Chrome version to ensure patch is applied
google-chrome --version
# Should show 124.0.6367.118 or higher

# Fedora update commands
sudo dnf update chromium