CVE-2024-4368: Google Chrome Use After Free Vulnerability

CVE-2024-4368 Overview

CVE-2024-4368 is a use-after-free vulnerability in the Dawn component of Google Chrome, the cross-platform implementation of the WebGPU standard. Versions of Google Chrome prior to 124.0.6367.118 are affected. A remote attacker can exploit heap corruption by serving a crafted HTML page to a victim, potentially leading to arbitrary code execution within the renderer process. The flaw is classified under CWE-416: Use After Free and was rated High by the Chromium security team. Fedora distributions shipping affected Chromium builds on Fedora 38, 39, and 40 are also impacted.

Critical Impact
A remote attacker who convinces a user to visit a crafted page can trigger heap corruption in the Dawn/WebGPU stack and potentially execute code in the renderer process.

Affected Products

Google Chrome versions prior to 124.0.6367.118
Fedora 38, 39, and 40 Chromium packages
Downstream Chromium-based browsers and embedded WebViews using the vulnerable Dawn component

Discovery Timeline

2024-05-01 - CVE-2024-4368 published to NVD
2025-03-13 - Last updated in NVD database

Technical Details for CVE-2024-4368

Vulnerability Analysis

The vulnerability resides in Dawn, the open-source WebGPU implementation that Chrome uses to expose modern GPU APIs to the web. Dawn translates WebGPU calls issued from JavaScript into native graphics API calls on the underlying platform. A use-after-free condition in this code path means an object is dereferenced after its backing memory has already been released and potentially reallocated for unrelated data.

When exploited, the dangling pointer access produces heap corruption inside the renderer process. An attacker who controls the contents of the freed region can influence object metadata, virtual function pointers, or GPU command buffers to redirect execution. Successful exploitation typically requires chaining with a sandbox escape to gain code execution outside the renderer.

Root Cause

The root cause is improper lifetime management of an object referenced through the WebGPU pipeline in Dawn. The flaw is tracked in the Chromium Issue Tracker. Detailed fix commits are restricted, consistent with Chromium's policy of withholding exploit-relevant detail until adoption of the patched release is widespread.

Attack Vector

Exploitation is network-based and requires user interaction. The victim must load a crafted HTML page in a vulnerable Chrome build with WebGPU enabled. The page issues a sequence of WebGPU calls that drive Dawn into the vulnerable state, after which the attacker grooms the heap and triggers the dangling reference. No authentication is required, and the attack works against the default browser configuration.

No verified exploitation code is available. See the Chromium security advisory for vendor guidance.

Detection Methods for CVE-2024-4368

Indicators of Compromise

Renderer process crashes referencing Dawn, WebGPU, or dawn_native modules in Chrome crash reports or Windows Error Reporting telemetry.
Chrome child processes spawning unexpected child binaries such as cmd.exe, powershell.exe, or shells on Linux shortly after browsing activity.
Outbound connections from Chrome renderer processes to untrusted domains immediately after page loads containing WebGPU content.

Detection Strategies

Inventory installed Chrome versions across the fleet and flag any instance below 124.0.6367.118.
Hunt for browser process trees where chrome.exe renderer children launch suspicious descendants, which can indicate post-exploitation activity following a renderer compromise.
Correlate browser crash telemetry with web proxy logs to identify users who visited unusual sites prior to a Dawn-related crash.

Monitoring Recommendations

Forward Chrome stability and crash telemetry to a centralized logging tier for retrospective hunting.
Monitor endpoint EDR telemetry for anomalous child process creation under the browser process tree.
Track WebGPU adoption in your environment so future Dawn vulnerabilities can be prioritized accurately.

How to Mitigate CVE-2024-4368

Immediate Actions Required

Update Google Chrome to version 124.0.6367.118 or later on all managed endpoints.
Apply Fedora package updates for Chromium on Fedora 38, 39, and 40 using dnf upgrade.
Restart browser sessions after patching so the new binary is loaded into memory.
Verify that auto-update is functioning and not blocked by group policy or network filtering.

Patch Information

Google released the fix in the Chrome Stable channel update announced on April 30, 2024. Refer to the Stable Channel Update for Desktop. Fedora published corresponding Chromium package updates via the Fedora package-announce list.

Workarounds

Disable WebGPU by setting the chrome://flags/#enable-unsafe-webgpu flag to Disabled and toggling chrome://flags/#enable-webgpu-developer-features off until patching completes.
Restrict access to untrusted external sites through web filtering or browser isolation for users who cannot update immediately.
Enforce Chrome enterprise policies that require the browser to remain within a supported version range.

bash

# Verify Chrome version on Linux endpoints
google-chrome --version

# Upgrade Chromium on Fedora
sudo dnf upgrade --refresh chromium

# Windows: confirm installed version via registry
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv