CVE-2024-6103: Google Chrome Use-After-Free Vulnerability

CVE-2024-6103 Overview

CVE-2024-6103 is a use-after-free vulnerability in the Dawn component of Google Chrome, the WebGPU implementation that translates graphics API calls to native GPU backends. The flaw affects Chrome versions prior to 126.0.6478.114. A remote attacker can exploit heap corruption by serving a crafted HTML page to a target user. Successful exploitation requires user interaction, typically loading or rendering the malicious page in a vulnerable browser. The Chromium project rated this issue High severity. The vulnerability maps to [CWE-416] Use After Free.

Critical Impact
A remote attacker can trigger heap corruption in the browser's GPU process, enabling potential arbitrary code execution within the browser context after the victim visits a crafted HTML page.

Affected Products

Google Chrome versions prior to 126.0.6478.114
Chromium-based browsers built on the same release branch
Fedora packages distributing affected Chromium builds

Discovery Timeline

2024-06-20 - CVE-2024-6103 published to the National Vulnerability Database
2024-11-21 - Last updated in the NVD database

Technical Details for CVE-2024-6103

Vulnerability Analysis

The defect resides in Dawn, Chrome's cross-platform implementation of the WebGPU standard. Dawn brokers GPU commands between JavaScript-exposed WebGPU APIs and underlying drivers such as Vulkan, Metal, and Direct3D. A use-after-free condition occurs when code dereferences a pointer to memory that has already been released back to the allocator. In a browser graphics pipeline, attacker-controlled JavaScript can issue sequences of WebGPU operations that release a GPU resource object while another reference still holds the freed address. Subsequent access yields heap corruption that an attacker can shape into arbitrary read or write primitives. The Dawn process runs with reduced privileges, but heap corruption here can be chained with sandbox escapes for broader impact.

Root Cause

The root cause is improper object lifetime management within Dawn's resource handling. Reference counts or ownership transitions on a WebGPU object are mismanaged, allowing the underlying heap allocation to be freed while a stale pointer remains reachable through scripted API calls.

Attack Vector

Exploitation is remote and requires user interaction. An attacker hosts a crafted HTML page that issues a tailored sequence of WebGPU calls. When a victim navigates to the page in a vulnerable Chrome build, the page triggers the use-after-free, corrupting Dawn process heap memory. No authentication is required.

No public proof-of-concept code has been verified for this issue. See the Chromium Issue Tracker Entry and the Chrome Blog Update Announcement for vendor-provided details.

Detection Methods for CVE-2024-6103

Indicators of Compromise

Chrome processes crashing with heap corruption signatures shortly after navigation to an untrusted page
GPU process termination logs referencing Dawn or WebGPU command buffers
Browser telemetry showing repeated tab crashes tied to specific origins serving WebGPU content
Chrome version strings reporting builds earlier than 126.0.6478.114 across the fleet

Detection Strategies

Inventory installed Chrome versions through endpoint management tooling and flag hosts below 126.0.6478.114
Monitor browser crash reports for signatures involving the GPU process or Dawn modules
Correlate web proxy logs with crash events to surface domains delivering malicious WebGPU payloads
Apply network-layer detections for known malicious domains and IPs distributing browser exploit kits

Monitoring Recommendations

Enable Chrome enterprise reporting to centralize version, crash, and extension telemetry
Forward browser and endpoint logs to a SIEM for correlation with threat intelligence feeds
Alert when unpatched Chrome installations communicate with newly registered or low-reputation domains
Track GPU process exit codes and abnormal renderer-to-GPU IPC patterns

How to Mitigate CVE-2024-6103

Immediate Actions Required

Update Google Chrome to version 126.0.6478.114 or later on all managed endpoints
Apply Fedora Chromium updates referenced in the Fedora Package Announcement
Validate auto-update functionality and force a relaunch for users who defer restarts
Restrict execution of unmanaged or out-of-date Chromium-based browsers via application control

Patch Information

Google addressed CVE-2024-6103 in the Stable channel release 126.0.6478.114 for Desktop. Refer to the Chrome Blog Update Announcement for full release notes. Fedora users should install the updated chromium packages from the project's package announcements.

Workarounds

Disable WebGPU via the chrome://flags/#enable-unsafe-webgpu setting where business needs allow
Use enterprise policy to block navigation to untrusted sites that require WebGPU content
Apply the HardwareAccelerationModeEnabled policy set to false as a temporary measure on high-risk endpoints
Educate users to avoid clicking links from untrusted sources until patches are deployed

bash

# Verify deployed Chrome version on Linux endpoints
google-chrome --version

# Force update on Debian/Ubuntu managed systems
sudo apt update && sudo apt install --only-upgrade google-chrome-stable

# Fedora package update
sudo dnf update chromium