CVE-2024-5495: Google Chrome Use After Free Vulnerability

CVE-2024-5495 Overview

CVE-2024-5495 is a use-after-free vulnerability [CWE-416] in the Dawn component of Google Chrome. Dawn is Chromium's cross-platform implementation of the WebGPU standard, exposing GPU functionality to web content. A remote attacker can exploit heap corruption by serving a crafted HTML page to a user running an affected Chrome build. Google fixed the issue in Chrome 125.0.6422.141, and Fedora 39 and 40 shipped corresponding package updates. The Chromium team rated the security severity as High.

Critical Impact
A crafted web page can corrupt heap memory in the renderer's GPU pipeline, enabling potential arbitrary code execution in the Chrome process context after a single user visit.

Affected Products

Google Chrome versions prior to 125.0.6422.141
Microsoft Windows hosts running affected Chrome builds
Fedora 39 and Fedora 40 distributions shipping vulnerable Chromium packages

Discovery Timeline

2024-05-30 - CVE-2024-5495 published to NVD
2024-12-26 - Last updated in NVD database

Technical Details for CVE-2024-5495

Vulnerability Analysis

The flaw resides in Dawn, the Chromium subsystem that implements WebGPU and brokers GPU operations between the renderer process and the system graphics stack. A use-after-free condition occurs when Dawn retains a reference to a heap object after that object has been released. Subsequent operations dereference the dangling pointer, producing heap corruption that can be steered toward attacker-controlled writes.

WebGPU exposes a wide programmable surface to JavaScript, including buffer creation, command encoding, and shader compilation. This surface gives attackers fine-grained control over allocation and free patterns, which is precisely the primitive needed to weaponize a use-after-free bug. Successful exploitation can lead to arbitrary code execution within the renderer or GPU process sandbox, providing a stepping stone for further sandbox escape research.

The attack requires user interaction, typically loading a malicious or compromised page, and no authentication. See the Chromium Issue Tracker Entry for upstream tracking.

Root Cause

The root cause is improper lifetime management of a heap-allocated object within Dawn. Code paths in the WebGPU pipeline continue to use a pointer after the underlying allocation has been freed, violating the object's lifecycle invariants and producing undefined behavior on the heap.

Attack Vector

Exploitation is remote and network-based. An attacker hosts a crafted HTML page containing JavaScript that issues a specific sequence of WebGPU API calls. When a victim visits the page in a vulnerable Chrome build, the renderer triggers the dangling reference and the attacker manipulates heap layout to gain control of execution flow.

The vulnerability mechanism is described in prose only because no verified public proof-of-concept code is available for CVE-2024-5495. Refer to the Google Chrome Update Announcement for the official advisory.

Detection Methods for CVE-2024-5495

Indicators of Compromise

Chrome renderer or GPU process crashes with heap corruption signatures referencing Dawn or WebGPU modules
Outbound connections from chrome.exe to unexpected hosts immediately following navigation to an untrusted page
Unexpected child processes spawned from the Chrome browser or GPU process
Browser telemetry showing sustained WebGPU API usage from low-reputation domains

Detection Strategies

Inventory Chrome installations across the fleet and flag any version below 125.0.6422.141
Correlate browser crash dumps with navigation history to identify pages triggering Dawn faults
Monitor endpoint EDR telemetry for anomalous post-exploitation behavior originating from Chrome processes, such as credential access or lateral movement attempts

Monitoring Recommendations

Enable enterprise reporting of Chrome version and crash events through the Chrome Enterprise management console
Forward browser process telemetry, including child-process creation and module loads, into the SIEM for retrospective hunting
Track domains and URLs that coincide with renderer crashes to build blocklists for suspected exploit pages

How to Mitigate CVE-2024-5495

Immediate Actions Required

Update Google Chrome to version 125.0.6422.141 or later on all Windows, macOS, and Linux endpoints
Apply the Fedora 39 and 40 Chromium package updates referenced in the Fedora package announcements
Restart browser sessions after patch deployment to ensure the vulnerable code is unloaded from memory
Restrict navigation to untrusted sites through web filtering until patch coverage is verified

Patch Information

Google released the fix in the Stable channel desktop update on May 30, 2024. The patched build is Chrome 125.0.6422.141 for Windows, macOS, and Linux. Fedora published corresponding updates documented in Fedora Package Announcement #1 and Fedora Package Announcement #2.

Workarounds

Disable WebGPU through the Chrome policy WebGPUEnabled or the runtime flag chrome://flags/#enable-unsafe-webgpu set to Disabled, where feasible
Enforce Site Isolation and the Enhanced Safe Browsing policy to reduce exposure to malicious pages
Apply browser isolation or remote browser technologies for high-risk user groups until patching completes

bash

# Configuration example: enforce minimum Chrome version and disable WebGPU via Chrome Enterprise policy on Windows
reg add "HKLM\SOFTWARE\Policies\Google\Chrome" /v WebGPUEnabled /t REG_DWORD /d 0 /f
reg add "HKLM\SOFTWARE\Policies\Google\Chrome" /v TargetVersionPrefix /t REG_SZ /d "125.0.6422.141" /f