CVE-2024-6293: Google Chrome Use After Free Vulnerability

CVE-2024-6293 Overview

CVE-2024-6293 is a use-after-free vulnerability in the Dawn component of Google Chrome prior to version 126.0.6478.126. Dawn is Chrome's open-source implementation of the WebGPU standard, which provides web applications with direct access to GPU functionality. A remote attacker can exploit heap corruption through a crafted HTML page, potentially leading to arbitrary code execution within the renderer process. Chromium classifies the security severity as High. The flaw is tracked under CWE-416: Use After Free and affects Chrome installations across Windows and Linux distributions including Fedora 39 and 40.

Critical Impact
Remote attackers can trigger heap corruption in the Chrome renderer by luring users to a malicious HTML page, enabling potential code execution within the browser sandbox.

Affected Products

Google Chrome versions prior to 126.0.6478.126
Microsoft Windows installations running vulnerable Chrome builds
Fedora 39 and Fedora 40 distributions packaging affected Chromium builds

Discovery Timeline

2024-06-24 - CVE-2024-6293 published to NVD following the Chrome Stable Channel update
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-6293

Vulnerability Analysis

The vulnerability resides in Dawn, the cross-platform implementation of WebGPU used by Chromium. Dawn translates WebGPU API calls from JavaScript into native graphics commands for Direct3D 12, Metal, Vulkan, and OpenGL backends. A use-after-free condition occurs when Dawn releases a heap-allocated object but retains a dangling pointer that subsequent code dereferences.

Attackers exploit this class of bug by triggering reallocation of the freed memory with attacker-controlled data. Once the stale pointer is reused, the attacker influences object virtual tables or function pointers within the renderer. Successful exploitation typically chains with a sandbox escape to achieve full system compromise.

The attack requires user interaction, meaning the victim must navigate to a crafted page or load embedded content from a malicious origin. Network-based delivery through advertising, watering holes, or phishing links remains the most realistic exploitation path.

Root Cause

The defect is categorized under CWE-416. Dawn's object lifetime management failed to invalidate or reference-count a GPU resource handle before the underlying memory was freed. When the renderer later accesses that handle, the freed slot may already contain a different object, producing type confusion or controlled heap corruption.

Attack Vector

Exploitation is remote and requires no privileges. The attacker hosts a webpage containing JavaScript that invokes WebGPU APIs in a sequence that triggers the dangling reference. When a user visits the page, Dawn processes the requests and reaches the vulnerable code path, corrupting the renderer heap.

No verified public proof-of-concept code is available for CVE-2024-6293. Technical details are referenced in the Chromium Issue Tracker Entry and the Chrome Desktop Update Blog.

Detection Methods for CVE-2024-6293

Indicators of Compromise

Chrome renderer processes crashing with access violations or heap corruption signatures shortly after WebGPU activity
Outbound connections from chrome.exe to unknown domains immediately following navigation to attacker-controlled HTML
Unexpected child processes spawned from Chrome renderer processes on endpoints running vulnerable versions

Detection Strategies

Inventory Chrome versions across the fleet and flag any installation below 126.0.6478.126 for remediation
Monitor browser telemetry for repeated renderer crashes correlated with WebGPU or Dawn-related stack frames
Apply network detection rules that identify suspicious downloads or shellcode patterns delivered to browser processes

Monitoring Recommendations

Enable Chrome enterprise reporting to surface crash dumps and version data to a central console
Correlate endpoint process telemetry with browser navigation logs to identify exploitation attempts originating from specific URLs
Track Chromium security release notes and subscribe to vendor channels for follow-up advisories tied to issue 345993680

How to Mitigate CVE-2024-6293

Immediate Actions Required

Update Google Chrome to version 126.0.6478.126 or later on all Windows, macOS, and Linux endpoints
Apply Fedora package updates referenced in the Fedora Package Announcement for Fedora 39 and 40 systems
Restart browser sessions after patching to ensure the vulnerable code is unloaded from memory

Patch Information

Google released the fix in the Chrome Stable Channel update published on June 24, 2024. The patched build is 126.0.6478.126/.127 for Windows and Mac and 126.0.6478.126 for Linux. Release details are documented in the Chrome Desktop Update Blog. Fedora users should consume the rebased Chromium packages distributed through the official Fedora updates channel.

Workarounds

Disable WebGPU through enterprise policy by setting the WebGpuEnabled policy to false until patching is complete
Restrict browsing on unpatched hosts to trusted internal sites using URL allowlists enforced through Chrome enterprise policies
Deploy network filtering to block known malicious domains hosting exploit content targeting Chromium browsers

bash

# Configuration example: disable WebGPU via Chrome enterprise policy on Linux
sudo mkdir -p /etc/opt/chrome/policies/managed
cat <<EOF | sudo tee /etc/opt/chrome/policies/managed/disable_webgpu.json
{
  "WebGpuEnabled": false
}
EOF