CVE-2024-5831: Google Chrome Use After Free Vulnerability

CVE-2024-5831 Overview

CVE-2024-5831 is a use-after-free vulnerability in the Dawn component of Google Chrome versions prior to 126.0.6478.54. Dawn is Chrome's implementation of the WebGPU API, which exposes GPU functionality to web content. A remote attacker can exploit heap corruption by convincing a user to visit a crafted HTML page. Successful exploitation can lead to arbitrary code execution within the renderer process. The Chromium project rated the security severity as High. Fedora 39 and Fedora 40 distributions were also affected through their Chromium package updates.

Critical Impact
A crafted HTML page can trigger heap corruption in Chrome's Dawn/WebGPU implementation, potentially enabling remote code execution in the renderer sandbox with high impact to confidentiality, integrity, and availability.

Affected Products

Google Chrome versions prior to 126.0.6478.54
Fedora 39 (Chromium package)
Fedora 40 (Chromium package)

Discovery Timeline

2024-06-11 - CVE-2024-5831 published to the National Vulnerability Database
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2024-5831

Vulnerability Analysis

The flaw is classified as a use-after-free condition [CWE-416] in Dawn, the cross-platform WebGPU implementation used by Chromium. Use-after-free defects occur when a program continues to reference memory after it has been released, allowing an attacker to control the contents of that reclaimed region. Because Dawn brokers GPU resources on behalf of untrusted web content, memory safety issues in this component are directly reachable from JavaScript. An attacker who lures a user to a malicious page can trigger the dangling reference and manipulate heap layout to gain code execution in the renderer process. The attack requires user interaction, limited to visiting a page, and does not require authentication.

Root Cause

The root cause is improper object lifetime management inside the Dawn WebGPU implementation. A GPU-facing object is freed while another code path retains a pointer to it, and the stale pointer is later dereferenced. When an attacker sprays the heap with controlled data before the dereference, the resulting write or virtual call operates on attacker-influenced memory. Details of the specific object type and code path are tracked in Chromium issue 339171223.

Attack Vector

Exploitation proceeds through a malicious HTML page that invokes WebGPU APIs in a specific sequence to reach the vulnerable code path in Dawn. The attacker allocates and frees GPU resources through scripted GPUDevice, GPUBuffer, or related object interactions, then reuses the freed slot with controlled data before the stale reference is used. Successful exploitation typically yields renderer-process code execution, which an attacker would then chain with a sandbox escape for full system compromise. No public proof-of-concept or exploit code has been observed for this issue.

Detection Methods for CVE-2024-5831

Indicators of Compromise

Chrome renderer processes crashing with heap corruption signatures such as SIGSEGV in Dawn or WebGPU frames on the stack.
Endpoints running Chrome builds earlier than 126.0.6478.54 accessing untrusted sites that invoke WebGPU APIs.
Unexpected child process creation or code execution originating from chrome.exe renderer processes after browsing activity.

Detection Strategies

Inventory installed Chrome and Chromium versions across managed endpoints and flag any build below 126.0.6478.54.
Correlate browser crash telemetry with URL history to identify pages that consistently trigger renderer faults involving Dawn.
Monitor for post-exploitation behaviors such as renderer processes spawning shells, PowerShell, or writing executables to disk.

Monitoring Recommendations

Ingest browser and endpoint telemetry into a central analytics platform to detect anomalous child processes of chrome.exe.
Track outbound network connections from renderer processes to newly registered or low-reputation domains.
Alert on Fedora package management events that indicate delayed application of the Chromium security update.

How to Mitigate CVE-2024-5831

Immediate Actions Required

Update Google Chrome to version 126.0.6478.54 or later on all Windows, macOS, and Linux endpoints.
Apply the corresponding Fedora Chromium package updates on Fedora 39 and Fedora 40 hosts.
Restart browsers after updating to ensure the patched binaries are loaded into memory.
Verify auto-update policies are enabled and functioning across the managed fleet.

Patch Information

Google released the fix in the Chrome Stable Channel update announced on June 10, 2024, shipping in version 126.0.6478.54. Fedora distributed corresponding Chromium package updates for Fedora 39 and Fedora 40. Refer to the Google Chrome Stable Update, the Chromium Issue Tracker Entry, and the Fedora advisories (FEDORA-2024-7VXA32LXMN, FEDORA-2024-MPU7AB53QQ) for release notes.

Workarounds

Disable WebGPU via the chrome://flags/#enable-unsafe-webgpu flag on unpatched systems where the feature is not required.
Enforce enterprise policies that block navigation to untrusted external sites until patching is complete.
Use site isolation and strict sandbox settings to limit the blast radius of a compromised renderer.

bash

# Verify installed Chrome version on Linux
google-chrome --version

# Update Chromium on Fedora 39/40
sudo dnf upgrade --refresh chromium

# Enterprise policy to disable WebGPU (Windows registry example)
reg add "HKLM\Software\Policies\Google\Chrome" /v "WebGPUEnabled" /t REG_DWORD /d 0 /f