CVE-2024-5160: Google Chrome Buffer Overflow Vulnerability

CVE-2024-5160 Overview

CVE-2024-5160 is a heap buffer overflow vulnerability in the Dawn component of Google Chrome. Dawn is Chrome's cross-platform implementation of the WebGPU standard, which exposes GPU functionality to web content. The flaw allows a remote attacker to perform an out-of-bounds memory write by serving a crafted HTML page to a target user. Successful exploitation requires user interaction, typically visiting a malicious or compromised website. Google addressed the issue in Chrome stable channel version 125.0.6422.76. Chromium classified the security severity as High, and the vulnerability is tracked under [CWE-787] (Out-of-Bounds Write) and [CWE-122] (Heap-Based Buffer Overflow).

Critical Impact
A remote attacker can trigger an out-of-bounds heap write in the renderer process via a crafted HTML page, enabling memory corruption that may lead to arbitrary code execution within the Chrome sandbox.

Affected Products

Google Chrome versions prior to 125.0.6422.76
Microsoft Windows installations running affected Chrome builds
Fedora 39 and Fedora 40 with affected Chromium packages

Discovery Timeline

2024-05-22 - CVE-2024-5160 published to NVD
2024-12-20 - Last updated in NVD database

Technical Details for CVE-2024-5160

Vulnerability Analysis

The vulnerability resides in Dawn, the WebGPU implementation shipped with Chrome. Dawn translates WebGPU API calls from JavaScript into native graphics API commands such as Vulkan, Metal, or Direct3D 12. The defect allows attacker-controlled input to write beyond the bounds of a heap-allocated buffer inside the renderer process.

Because WebGPU exposes a complex command-buffer and resource model to untrusted web content, validation gaps in argument handling or resource sizing can produce writes past allocated boundaries. The vulnerability is reachable from any web page that can invoke WebGPU on a vulnerable browser, with user interaction limited to loading the page.

For technical specifics, see the Chromium Issue Tracker Entry and the Chrome Releases Update.

Root Cause

The root cause is a heap buffer overflow [CWE-122] in Dawn, where the component performs an out-of-bounds write [CWE-787] when processing crafted input from the WebGPU surface. Insufficient bounds checking on attacker-influenced sizes or offsets allows the write to land outside the intended heap allocation, corrupting adjacent memory structures.

Attack Vector

Exploitation occurs over the network through a crafted HTML page that issues malicious WebGPU calls. The user must navigate to the page or load it via an embedded frame. Once triggered, the out-of-bounds write corrupts renderer heap memory, which an attacker can shape to influence control flow. Code execution remains constrained by Chrome's sandbox unless chained with a sandbox escape.

No public proof-of-concept exploit is listed in NVD references, and the vulnerability is not present in the CISA Known Exploited Vulnerabilities catalog at the time of publication.

Detection Methods for CVE-2024-5160

Indicators of Compromise

Chrome renderer process crashes referencing Dawn or WebGPU modules in crash dumps, particularly heap corruption signatures from dawn_native or dawn_wire.
Unexpected child process spawning or anomalous network connections originating from Chrome renderer processes after visiting unfamiliar websites.
Browser telemetry showing visits to pages that invoke WebGPU APIs from low-reputation or newly registered domains.

Detection Strategies

Inventory installed Chrome versions across the fleet and flag any instance below 125.0.6422.76 as vulnerable.
Monitor endpoint EDR telemetry for Chrome renderer crashes with heap corruption exception codes such as 0xC0000374 on Windows.
Correlate web proxy logs with browsing to domains hosting WebGPU content alongside subsequent renderer instability.

Monitoring Recommendations

Forward Chrome crash reports and browser version inventory into a centralized analytics platform for version-compliance reporting.
Alert on post-exploitation behaviors such as suspicious process injection, credential access, or persistence originating from chrome.exe.
Track Fedora package update status on Linux endpoints to confirm Chromium patches from the Fedora Package Announcement are applied.

How to Mitigate CVE-2024-5160

Immediate Actions Required

Update Google Chrome to version 125.0.6422.76 or later on all Windows, macOS, and Linux endpoints.
Apply Chromium updates from the relevant Fedora Package Announcement on Fedora 39 and Fedora 40 systems.
Restart browser sessions after patching to ensure the updated binary is loaded into memory.
Verify enterprise update channels and Group Policy settings are not blocking Chrome auto-update.

Patch Information

Google released the fix in Chrome stable channel 125.0.6422.76 for Windows, Mac, and Linux. Details are published in the Chrome Releases Update. Fedora distributed corresponding Chromium package updates through its security advisory mailing list. Administrators should confirm patch deployment using browser version inventory queries.

Workarounds

Disable WebGPU through the chrome://flags/#enable-unsafe-webgpu setting where business workflows do not require it.
Apply enterprise policy URLBlocklist to restrict access to untrusted sites that may host WebGPU-based exploits until patching completes.
Use site isolation and strict sandboxing defaults, which remain enabled in Chrome by default, to limit renderer process impact.

bash

# Verify installed Chrome version on Linux
google-chrome --version

# Update Chromium on Fedora
sudo dnf upgrade --refresh chromium

# Verify installed Chrome version on Windows (PowerShell)
(Get-Item "$env:ProgramFiles\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion