CVE-2024-6102: Google Chrome Dawn RCE Vulnerability

CVE-2024-6102 Overview

CVE-2024-6102 is an out-of-bounds memory access vulnerability in the Dawn component of Google Chrome prior to version 126.0.6478.114. Dawn is Google's implementation of the WebGPU standard, providing low-level GPU access for web applications. This vulnerability allows a remote attacker to potentially exploit heap corruption via a crafted HTML page, which could lead to arbitrary code execution in the context of the browser.

Critical Impact

A remote attacker can exploit this heap corruption vulnerability through a malicious HTML page to potentially execute arbitrary code, compromise user data, or take control of the affected system.

Affected Products

• Google Chrome versions prior to 126.0.6478.114
• Chromium-based browsers using vulnerable Dawn component
• Fedora packages containing vulnerable Chrome/Chromium builds

Discovery Timeline

• 2024-06-20 - CVE-2024-6102 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-6102

Vulnerability Analysis

This vulnerability affects the Dawn graphics library, which serves as the WebGPU implementation in Chrome. The out-of-bounds memory access occurs when processing specially crafted WebGPU content, leading to potential heap corruption. The vulnerability is classified under both CWE-787 (Out-of-bounds Write) and CWE-125 (Out-of-bounds Read), indicating that an attacker can both read and write beyond allocated memory boundaries.

The network-based attack vector means exploitation requires user interaction—specifically, the victim must visit a malicious webpage containing the crafted HTML payload. Upon successful exploitation, an attacker could achieve high impact to confidentiality, integrity, and availability of the target system, potentially leading to full browser compromise or sandbox escape.

Root Cause

The root cause of this vulnerability lies in improper bounds checking within the Dawn WebGPU implementation. When processing certain GPU-related operations, the code fails to properly validate memory access boundaries, allowing reads or writes to occur outside the intended buffer regions. This memory safety issue in the graphics pipeline can be triggered through WebGPU API calls from JavaScript, making it exploitable via web content.

Attack Vector

The attack vector for CVE-2024-6102 is network-based and requires user interaction. An attacker would need to:

1. Create a malicious HTML page containing specially crafted WebGPU API calls
2. Lure a victim to visit the malicious page
3. The crafted content triggers the out-of-bounds memory access in Dawn
4. Heap corruption occurs, potentially allowing code execution

The vulnerability is exploited through the browser's rendering of malicious web content. No special privileges are required from the attacker's perspective, and the attack can be delivered through various means including phishing links, malicious advertisements, or compromised websites.

Detection Methods for CVE-2024-6102

Indicators of Compromise

• Unusual Chrome process crashes or hangs when visiting unfamiliar websites
• Memory access violations or heap corruption errors in Chrome crash reports
• Unexpected WebGPU-related errors in browser developer console
• Anomalous GPU process behavior or resource consumption

Detection Strategies

• Monitor for Chrome versions below 126.0.6478.114 across the enterprise
• Deploy endpoint detection to identify heap corruption attempts in browser processes
• Review browser crash reports for Dawn-related memory access violations
• Implement web filtering to block known malicious domains serving exploit content

Monitoring Recommendations

• Enable enhanced browser telemetry to capture GPU process anomalies
• Configure SentinelOne agents to monitor Chrome process memory for corruption patterns
• Set up alerts for multiple browser crashes on the same endpoint within a short timeframe
• Review network traffic for suspicious WebGPU-heavy content from untrusted sources

How to Mitigate CVE-2024-6102

Immediate Actions Required

• Update Google Chrome to version 126.0.6478.114 or later immediately
• Enable automatic updates for Chrome to ensure timely patching of future vulnerabilities
• Audit all systems for vulnerable Chrome versions and prioritize updates
• Consider temporarily restricting access to untrusted websites on critical systems

Patch Information

Google has released Chrome version 126.0.6478.114 that addresses this vulnerability. The fix was announced in the Google Chrome Stable Update on June 18, 2024. Additional details can be found in the Chromium Issue Tracker Entry. Fedora users should apply the relevant package updates from the Fedora Package Announcement.

Workarounds

• If immediate patching is not possible, consider using browser sandboxing or virtualization for high-risk browsing
• Disable WebGPU functionality via Chrome flags (chrome://flags/#enable-unsafe-webgpu) as a temporary measure
• Implement strict web filtering policies to reduce exposure to potentially malicious content
• Use network segmentation to isolate systems that cannot be immediately updated

# Check current Chrome version
google-chrome --version

# On Linux, update Chrome via package manager
sudo apt update && sudo apt upgrade google-chrome-stable

# Or for Fedora systems
sudo dnf update chromium