CVE-2024-6990: Google Chrome Use After Free Vulnerability

CVE-2024-6990 Overview

CVE-2024-6990 is an uninitialized memory use vulnerability in the Dawn component of Google Chrome on Android. Dawn is Chrome's cross-platform implementation of the WebGPU standard. Versions of Chrome prior to 127.0.6533.88 are affected. A remote attacker can serve a crafted HTML page that triggers out-of-bounds memory access through uninitialized variable use. Chromium rates the security severity as Critical. The flaw maps to [CWE-457: Use of Uninitialized Variable] and [CWE-908: Use of Uninitialized Resource]. User interaction is required, since the victim must load attacker-controlled web content.

Critical Impact
Remote attackers can exploit uninitialized memory in Dawn via a crafted HTML page to achieve out-of-bounds memory access in the Chrome renderer process on Android.

Affected Products

Google Chrome on Android prior to 127.0.6533.88
Chromium-based browsers shipping the affected Dawn/WebGPU implementation
Embedded WebView components that bundle vulnerable Chromium builds

Discovery Timeline

2024-07-30 - Google releases stable channel update addressing the issue
2024-08-01 - CVE-2024-6990 published to NVD
2024-08-16 - Last updated in NVD database

Technical Details for CVE-2024-6990

Vulnerability Analysis

The vulnerability resides in Dawn, the WebGPU implementation embedded in Chrome. Dawn translates WebGPU API calls from JavaScript into native graphics commands for the underlying GPU backend. The defect involves use of an uninitialized variable or resource during this translation path. When the uninitialized value is consumed as an index, pointer, or size parameter, it leads to out-of-bounds memory access. The flaw is reachable from any web origin, which removes authentication barriers for exploitation. Successful exploitation can compromise renderer-process confidentiality, integrity, and availability.

Root Cause

The root cause is improper initialization of memory or object state inside Dawn before the value is consumed by subsequent logic. Both [CWE-457] and [CWE-908] describe scenarios where uninitialized storage carries residual data from prior allocations. When that residual data is interpreted as a buffer length, offset, or descriptor field, downstream code performs reads or writes outside intended bounds. Details are tracked in the Chromium Issue Tracker entry.

Attack Vector

Exploitation requires a victim to visit a malicious or compromised website with a vulnerable Chrome build. The attacker delivers a crafted HTML page that invokes specific WebGPU API sequences through JavaScript. These calls drive Dawn into the code path that uses uninitialized data. The result is out-of-bounds memory access within the renderer sandbox. An attacker can chain this primitive with a sandbox escape to achieve broader impact. See the Google Chrome update blog post for vendor confirmation. No public proof-of-concept is currently available, and the vulnerability is not listed in CISA KEV.

Detection Methods for CVE-2024-6990

Indicators of Compromise

Chrome renderer process crashes on Android devices correlated with WebGPU activity or chrome://gpu features
Outbound connections from mobile endpoints to untrusted domains immediately preceding renderer crash signals
Browser telemetry showing repeated visits to pages invoking unusual WebGPU shader or buffer allocation patterns

Detection Strategies

Inventory Chrome installations on Android fleets and flag any build below 127.0.6533.88
Monitor mobile EDR telemetry for Chrome process abnormal terminations and child process spawning
Inspect web proxy logs for HTML responses containing dense WebGPU API usage from low-reputation domains

Monitoring Recommendations

Forward Chrome crash reports and mobile browser telemetry into a centralized analytics pipeline for correlation
Alert on version drift when managed Android devices report Chrome versions below the patched release
Track threat intelligence feeds for newly published WebGPU and Dawn exploit research tied to this CVE

How to Mitigate CVE-2024-6990

Immediate Actions Required

Update Google Chrome on Android to version 127.0.6533.88 or later through Google Play
Push managed configuration via mobile device management to enforce automatic Chrome updates
Communicate to users that they should restart Chrome after the update to fully apply the fix

Patch Information

Google addressed CVE-2024-6990 in the Chrome stable channel update released on July 30, 2024. The fixed version on Android is 127.0.6533.88. Refer to the Google Chrome update blog post for the full advisory and the Chromium Issue Tracker entry for engineering details.

Workarounds

Disable WebGPU on managed Android Chrome deployments using enterprise policy until patching is complete
Restrict browsing to trusted domains through mobile threat defense or DNS filtering policies
Block known malicious infrastructure at the network egress point to reduce delivery of crafted HTML payloads

bash

# Chrome enterprise policy to disable WebGPU until devices are patched
# Deploy via Android Enterprise managed configuration for com.android.chrome
{
  "PolicySchema": {
    "WebGPUEnabled": false,
    "DefaultJavaScriptSetting": 2,
    "URLBlocklist": ["*"],
    "URLAllowlist": ["https://*.corp.example.com"]
  }
}