CVE-2024-5494: Google Chrome Use After Free Vulnerability

CVE-2024-5494 Overview

CVE-2024-5494 is a use-after-free vulnerability in the Dawn component of Google Chrome. Dawn is Chromium's cross-platform implementation of the WebGPU standard, exposing GPU functionality to web content. A remote attacker can exploit heap corruption by serving a crafted HTML page to a target user. Successful exploitation can compromise the renderer process and provide a foundation for broader attacks such as sandbox escapes. The vulnerability affects Google Chrome versions prior to 125.0.6422.141 on Windows and Linux distributions including Fedora 39 and 40. The flaw is tracked under CWE-416: Use After Free and was rated High severity by the Chromium security team.

Critical Impact
A remote attacker can trigger heap corruption through a crafted web page, leading to potential code execution within the Chrome renderer process.

Affected Products

Google Chrome versions prior to 125.0.6422.141
Microsoft Windows installations running affected Chrome builds
Fedora Project Fedora 39 and 40 (Chromium package)

Discovery Timeline

2024-05-30 - CVE-2024-5494 published to the National Vulnerability Database
2024-12-26 - Last updated in NVD database

Technical Details for CVE-2024-5494

Vulnerability Analysis

The flaw resides in Dawn, the WebGPU implementation used by Chromium. WebGPU exposes GPU compute and rendering primitives to JavaScript running in the browser. A use-after-free condition occurs when Dawn references a heap object after it has been released. An attacker who controls the freed memory region can influence subsequent reads or writes performed against the dangling pointer. This primitive enables heap corruption that can be shaped into control-flow hijacking or arbitrary read/write within the renderer. User interaction is required, since the victim must load attacker-controlled HTML that issues the malicious WebGPU sequence.

Root Cause

The root cause is improper lifetime management of an internal Dawn object [CWE-416]. Specific operations sequenced against the WebGPU device or its associated resources release the object while another reference is still active. When the surviving reference is later dereferenced, the allocator may have reused the slot for attacker-controlled data, producing type confusion and corrupted heap metadata. Details of the affected object and call path are tracked in the Chromium Issue Tracker Entry.

Attack Vector

Exploitation is network-based and remote. An attacker hosts a crafted HTML page that invokes WebGPU APIs through JavaScript to drive Dawn into the vulnerable state. Once the victim visits the page using a vulnerable Chrome build, the renderer process executes the malicious sequence and the use-after-free is triggered. The bug yields renderer-level compromise, which adversaries typically chain with a sandbox-escape vulnerability to reach the host operating system.

No public proof-of-concept has been published. Refer to the Chromium Issue Tracker Entry for technical details once Google removes the access restriction.

Detection Methods for CVE-2024-5494

Indicators of Compromise

Chrome renderer process crashes referencing Dawn or WebGPU modules in crash dumps
Outbound connections from browser hosts to recently registered domains immediately following a Chrome crash
Unexpected child processes spawned by chrome.exe after rendering attacker-controlled content
Browser telemetry showing WebGPU API usage from pages on uncategorized or low-reputation domains

Detection Strategies

Inventory installed Chrome versions across endpoints and flag any build below 125.0.6422.141
Correlate browser process crashes with subsequent process creation, file writes, or persistence events
Monitor for renderer sandbox token anomalies and unexpected handle duplication originating from Chrome
Alert on HTML payloads delivered via email or messaging that reference WebGPU initialization patterns

Monitoring Recommendations

Forward Chrome stability and crash telemetry to a central log store for retrospective hunting
Track DNS and HTTP requests preceding renderer crashes to identify exploit delivery infrastructure
Apply EDR rules that detect Chrome spawning shells, scripting hosts, or LOLBins after page loads
Review Fedora dnf update logs to confirm Chromium package versions are current on Linux endpoints

How to Mitigate CVE-2024-5494

Immediate Actions Required

Update Google Chrome to version 125.0.6422.141 or later on all managed endpoints
Apply the Fedora Chromium security updates referenced in the package-announce advisories
Restart browser sessions after patching to ensure the new binary is loaded into memory
Block known malicious domains and inspect web traffic for crafted WebGPU payloads

Patch Information

Google addressed the vulnerability in Chrome 125.0.6422.141 for the Stable channel, as documented in the Google Chrome Stable Update. Fedora distributed corresponding Chromium updates through the Fedora Package Announcement and the Fedora Security Update Notice. Enterprise administrators should validate auto-update enforcement through Chrome Browser Cloud Management or equivalent endpoint configuration tooling.

Workarounds

Disable WebGPU via the chrome://flags/#enable-unsafe-webgpu flag and enterprise policy until patching completes
Restrict browser usage to a curated allowlist of trusted sites on systems that cannot be updated promptly
Enforce site isolation and the strictest Safe Browsing policy through group policy or Chrome Enterprise settings
Segment high-value workstations so that a compromised renderer cannot pivot to sensitive internal services

bash

# Verify the installed Chrome version on Linux
google-chrome --version

# Update Chromium on Fedora
sudo dnf upgrade --refresh chromium

# Confirm the resulting package version
rpm -q chromium