CVE-2024-6102: Google Chrome Buffer Overflow Vulnerability

CVE-2024-6102 Overview

CVE-2024-6102 is an out-of-bounds memory access vulnerability in the Dawn component of Google Chrome prior to version 126.0.6478.114. Dawn is Chrome's open-source implementation of the WebGPU standard, which provides web pages with access to GPU resources. A remote attacker can exploit this flaw by serving a crafted HTML page to a target user, triggering heap corruption in the renderer process. The Chromium security team rated this issue High severity, and the underlying weaknesses are tracked as CWE-787 (Out-of-bounds Write) and CWE-125 (Out-of-bounds Read).

Critical Impact
Successful exploitation can lead to heap corruption and potential arbitrary code execution within the Chrome renderer process after a user visits a malicious web page.

Affected Products

Google Chrome versions prior to 126.0.6478.114
Chromium-based browsers shipping the vulnerable Dawn/WebGPU implementation
Fedora Linux distributions packaging vulnerable Chromium builds

Discovery Timeline

2024-06-20 - CVE-2024-6102 published to the National Vulnerability Database (NVD)
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-6102

Vulnerability Analysis

The vulnerability resides in Dawn, the cross-platform WebGPU implementation embedded in Chrome. Dawn translates WebGPU API calls from JavaScript into native graphics commands for Direct3D, Metal, or Vulkan backends. An out-of-bounds memory access occurs when Dawn processes specific GPU command sequences or resource descriptors supplied through the WebGPU API. The bug allows a renderer to read or write memory outside the bounds of an intended buffer, producing heap corruption.

Because WebGPU is reachable from any rendered web page once enabled, an attacker can trigger the condition without authentication. User interaction is limited to visiting an attacker-controlled page. Exploitation primarily impacts the renderer process, but heap corruption in this surface has historically been chained with sandbox escapes to achieve broader compromise.

Root Cause

The root cause is improper bounds checking on memory operations within Dawn's command processing logic. When the WebGPU layer receives malformed or unexpected parameters from JavaScript, the affected code path performs reads or writes against a heap allocation using indices or sizes that are not properly validated. This produces both out-of-bounds read ([CWE-125]) and out-of-bounds write ([CWE-787]) primitives, leading to memory corruption in the GPU process address space.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker hosts a crafted HTML page that loads JavaScript invoking the WebGPU API with malicious parameters. When a victim using a vulnerable Chrome build visits the page, Dawn's command handling triggers the out-of-bounds access. No prior authentication or elevated privileges are required. Refer to the Chromium Issue Report and the Google Chrome Stability Update for vendor-confirmed details.

No public proof-of-concept exploit code is available in trusted repositories, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2024-6102

Indicators of Compromise

Unexpected Chrome renderer or GPU process crashes with heap corruption signatures shortly after browsing untrusted sites
Browser crash dump entries referencing Dawn, WebGPU, or dawn_native modules
Outbound connections from Chrome child processes to unfamiliar domains following a crash event

Detection Strategies

Inventory installed Chrome versions across the fleet and flag any build below 126.0.6478.114
Monitor endpoint telemetry for repeated Chrome renderer crashes correlated with WebGPU usage
Inspect proxy and DNS logs for users visiting pages that trigger GPU process crashes

Monitoring Recommendations

Aggregate Chrome version data and crash telemetry in a central logging or SIEM platform for trend analysis
Alert on Chrome child processes spawning unexpected subprocesses or writing to sensitive locations
Track Chromium security release notes to correlate new advisories with observed crash patterns

How to Mitigate CVE-2024-6102

Immediate Actions Required

Update Google Chrome to version 126.0.6478.114 or later on all managed endpoints
Apply Fedora package updates referenced in the Fedora Package Announcement and the follow-up Fedora advisory
Verify enterprise auto-update policies are enforcing the patched build and not pinning users to vulnerable versions

Patch Information

Google addressed CVE-2024-6102 in the Stable Channel update for desktop released on June 18, 2024, which ships Chrome 126.0.6478.114 and later. Administrators should consult the Google Chrome Stability Update for full release notes and verify deployment through Chrome's chrome://settings/help page or enterprise management tooling.

Workarounds

Disable WebGPU via enterprise policy or the chrome://flags/#enable-unsafe-webgpu flag until patching is complete
Restrict browsing to trusted sites through proxy or DNS filtering for unpatched hosts
Use site isolation and standard Chrome sandboxing defaults to limit the blast radius of renderer compromise

bash

# Verify the installed Chrome version on Linux endpoints
google-chrome --version

# Update Chrome on Fedora systems
sudo dnf upgrade --refresh google-chrome-stable

# Example Windows Group Policy registry key to enforce auto-update
reg add "HKLM\SOFTWARE\Policies\Google\Update" /v UpdateDefault /t REG_DWORD /d 1 /f