CVE-2024-5834: Google Chrome Dawn RCE Vulnerability

CVE-2024-5834 Overview

CVE-2024-5834 is a code injection vulnerability affecting Google Chrome's Dawn component, the WebGPU implementation. An inappropriate implementation flaw allows a remote attacker to execute arbitrary code when a victim visits a crafted HTML page. This vulnerability poses significant risk as it can be exploited through standard web browsing activity without requiring any special privileges.

Critical Impact

Remote code execution via crafted HTML page targeting Chrome's Dawn WebGPU component - users can be compromised simply by visiting a malicious website.

Affected Products

• Google Chrome versions prior to 126.0.6478.54
• Fedora Project Fedora 39
• Fedora Project Fedora 40

Discovery Timeline

• 2024-06-11 - CVE-2024-5834 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-5834

Vulnerability Analysis

The vulnerability exists within Dawn, Google Chrome's native implementation of the WebGPU API. Dawn serves as the cross-platform abstraction layer enabling hardware-accelerated graphics and compute operations within the browser. The inappropriate implementation in this component creates a pathway for code injection attacks.

When processing certain inputs through the WebGPU interface, the Dawn component fails to properly validate or handle data, resulting in a condition where attacker-controlled code can be executed within the browser's rendering process. The network-accessible attack vector combined with low attack complexity makes this vulnerability particularly dangerous for end users who may unknowingly visit malicious websites.

Root Cause

The root cause stems from an inappropriate implementation in the Dawn component (CWE-94: Code Injection). The specific implementation flaw allows external input from a crafted HTML page to influence code execution paths in ways not intended by the developers. This type of vulnerability typically arises from insufficient validation of WebGPU API parameters or improper handling of GPU command buffers.

Attack Vector

The attack leverages Chrome's WebGPU functionality through a specially crafted HTML page. An attacker can host a malicious webpage that, when visited by a victim using a vulnerable Chrome version, triggers the inappropriate implementation bug in Dawn. The attack requires user interaction (visiting the page) but no authentication or special privileges.

The attack flow typically follows this pattern:

1. Attacker creates a malicious HTML page with crafted WebGPU API calls
2. Victim visits the attacker-controlled webpage using vulnerable Chrome
3. Chrome's Dawn component processes the malicious WebGPU commands
4. The inappropriate implementation allows arbitrary code execution

For detailed technical information about this vulnerability, refer to the Chromium Issue Tracker Entry and the Google Chrome Stable Update announcement.

Detection Methods for CVE-2024-5834

Indicators of Compromise

• Unusual GPU process crashes or abnormal Chrome renderer behavior
• Unexpected WebGPU API utilization in network traffic or browser logs
• Signs of code execution originating from the Chrome GPU process
• Suspicious HTML/JavaScript files containing WebGPU Dawn-specific code patterns

Detection Strategies

• Monitor Chrome version deployments across endpoints to identify vulnerable installations (versions below 126.0.6478.54)
• Implement browser extension or endpoint detection rules to flag unusual WebGPU API behavior
• Deploy web filtering solutions to block known malicious domains attempting to exploit WebGPU vulnerabilities
• Enable Chrome's enhanced safe browsing mode to detect potentially malicious pages

Monitoring Recommendations

• Configure endpoint detection and response (EDR) solutions to monitor Chrome GPU process activities
• Establish baselines for normal WebGPU usage patterns to detect anomalous behavior
• Review browser crash reports for Dawn-related exceptions that may indicate exploitation attempts
• Enable verbose Chrome logging in high-security environments to capture WebGPU API interactions

How to Mitigate CVE-2024-5834

Immediate Actions Required

• Update Google Chrome to version 126.0.6478.54 or later immediately across all endpoints
• Fedora 39 and 40 users should apply the latest chromium package updates via their package manager
• Consider temporarily disabling WebGPU functionality via Chrome flags (chrome://flags/#enable-unsafe-webgpu) in high-risk environments until patches are deployed
• Implement network-level protections to block known malicious domains

Patch Information

Google has addressed this vulnerability in Chrome version 126.0.6478.54. The fix is included in the stable channel update released on June 11, 2024. Users should update Chrome immediately via the browser's built-in update mechanism:

1. Open Chrome and navigate to chrome://settings/help
2. Chrome will automatically check for and install updates
3. Restart the browser to complete the update process

Fedora users can update via:

• Fedora 39/40: sudo dnf update chromium

For additional details, see the Google Chrome Stable Update announcement and the Fedora Package Announcement.

Workarounds

• Disable WebGPU in Chrome by setting the flag --disable-features=Vulkan,WebGPU at browser startup
• Use Chrome's site isolation features to limit the impact of potential exploitation
• Deploy content security policies (CSP) on internal web applications to restrict WebGPU usage
• Consider using browser virtualization or sandboxing solutions for high-risk browsing activities

# Disable WebGPU temporarily via Chrome flags
# Launch Chrome with WebGPU disabled
google-chrome --disable-features=Vulkan,WebGPU

# Verify Chrome version (should be 126.0.6478.54 or higher)
google-chrome --version

# Fedora update command
sudo dnf update chromium