CVE-2024-6292: Google Chrome Use After Free Vulnerability

CVE-2024-6292 Overview

CVE-2024-6292 is a use-after-free vulnerability [CWE-416] in the Dawn component of Google Chrome. Dawn is Chrome's WebGPU implementation that translates WebGPU API calls to native graphics APIs. Versions of Google Chrome prior to 126.0.6478.126 are affected. A remote attacker can exploit heap corruption by convincing a user to visit a crafted HTML page. Successful exploitation can lead to arbitrary code execution within the renderer process. Google rated this issue as High severity in its Chromium security advisory.

Critical Impact
Remote attackers can trigger heap corruption in the Chrome renderer through a malicious web page, potentially leading to arbitrary code execution after user interaction.

Affected Products

Google Chrome versions prior to 126.0.6478.126
Microsoft Windows builds shipping the vulnerable Chrome package
Fedora 39 and Fedora 40 distributions shipping the vulnerable Chrome package

Discovery Timeline

2024-06-24 - CVE-2024-6292 published to the National Vulnerability Database
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2024-6292

Vulnerability Analysis

The flaw exists in Dawn, the WebGPU implementation used by Chromium-based browsers. WebGPU exposes low-level GPU operations to web content through JavaScript. Dawn manages the lifecycle of GPU objects such as devices, buffers, textures, and command encoders. A use-after-free condition occurs when one of these GPU objects is freed while a reference to it remains reachable from JavaScript or internal Dawn state. Subsequent operations on the stale reference manipulate freed heap memory, producing heap corruption that an attacker can shape into a controlled write or read primitive.

The issue is reachable through standard WebGPU API calls from a crafted HTML page, meaning no special browser configuration is required beyond WebGPU being enabled. Exploitation requires user interaction in the form of visiting an attacker-controlled site.

Root Cause

The root cause is improper object lifetime management in Dawn. A GPU resource is released while another code path still holds a usable pointer to it. When that path dereferences the pointer, it operates on memory that may have been reallocated for an attacker-controlled object. This pattern is consistent with [CWE-416: Use After Free]. Public technical details are limited; refer to the Chromium Issue Tracker for restricted bug details and the Google Chrome stable channel update for the official fix announcement.

Attack Vector

The attack is network-based and requires user interaction. An attacker hosts a malicious HTML page that issues a sequence of WebGPU calls designed to trigger the freed-object reuse. When a victim visits the page in a vulnerable Chrome build, Dawn processes the crafted GPU operations and corrupts the heap. Combined with a renderer sandbox escape, this can lead to code execution on the host. The EPSS probability for this issue is 0.509% (percentile 39.363) as of 2026-06-23.

No verified public proof-of-concept code is available for this vulnerability. The vulnerability mechanism is described above in prose; see the referenced advisories for additional context.

Detection Methods for CVE-2024-6292

Indicators of Compromise

Renderer process crashes in chrome.dll or the Dawn module accompanied by heap corruption signatures in Windows Error Reporting or core dumps on Linux.
Outbound connections from browser processes to recently registered or low-reputation domains hosting WebGPU-heavy content.
Unexpected child processes spawned by chrome.exe shortly after browsing activity, suggesting a successful sandbox escape chain.

Detection Strategies

Inventory installed Chrome versions across endpoints and flag any build below 126.0.6478.126.
Monitor for browser renderer crashes with exception codes consistent with heap corruption such as STATUS_HEAP_CORRUPTION or SIGSEGV in GPU command processing.
Correlate browsing telemetry with EDR process trees to detect anomalous post-navigation process creation from the browser.

Monitoring Recommendations

Ingest Chrome update telemetry and patch compliance reports into a central log platform to track exposure over time.
Alert on script-heavy pages invoking WebGPU from untrusted origins, especially when paired with reconnaissance behaviors.
Track repeated browser crashes per user as a low-noise signal of in-the-wild exploitation attempts against memory safety bugs.

How to Mitigate CVE-2024-6292

Immediate Actions Required

Update Google Chrome to version 126.0.6478.126 or later on all managed endpoints.
Apply the corresponding Fedora 39 and Fedora 40 Chrome package updates referenced in the Fedora package announcements.
Restart the browser after deployment to ensure the patched binary is loaded into memory.

Patch Information

Google addressed CVE-2024-6292 in the Stable channel update for desktop released on June 24, 2024, shipping Chrome 126.0.6478.126/.127 for Windows and Mac and 126.0.6478.126 for Linux. Patch details are published in the Chrome Releases blog. Fedora updates are tracked in the Fedora 39 advisory and Fedora 40 advisory.

Workarounds

Disable WebGPU by setting the chrome://flags/#enable-unsafe-webgpu flag to Disabled on hosts that cannot be updated immediately.
Apply enterprise policy to block navigation to untrusted external sites until patching is complete.
Enforce automatic Chrome updates through ChromeUpdate group policies to prevent regression to vulnerable builds.

bash

# Configuration example: enforce minimum Chrome version via Windows registry policy
reg add "HKLM\Software\Policies\Google\Update" /v UpdateDefault /t REG_DWORD /d 1 /f
reg add "HKLM\Software\Policies\Google\Update" /v AutoUpdateCheckPeriodMinutes /t REG_DWORD /d 60 /f
# Verify installed version meets or exceeds 126.0.6478.126
wmic datafile where name="C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" get Version