CVE-2024-9960 Overview
CVE-2024-9960 is a use-after-free vulnerability in the Dawn component of Google Chrome. Dawn is Chromium's cross-platform implementation of the WebGPU standard. Versions of Chrome prior to 130.0.6723.58 are affected. A remote attacker can exploit heap corruption by serving a crafted HTML page to a victim. Successful exploitation requires user interaction, such as visiting a malicious website. The flaw is tracked under CWE-416: Use After Free.
Critical Impact
Remote attackers can trigger heap corruption in the GPU process via a crafted web page, potentially leading to arbitrary code execution within the renderer or GPU sandbox.
Affected Products
- Google Chrome versions prior to 130.0.6723.58
- Chromium-based browsers incorporating the vulnerable Dawn/WebGPU component
- Desktop builds across Windows, macOS, and Linux
Discovery Timeline
- 2024-10-15 - Google releases the Stable Channel update addressing the issue
- 2024-10-15 - CVE-2024-9960 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-9960
Vulnerability Analysis
The vulnerability resides in Dawn, the WebGPU implementation used by Chromium to expose GPU functionality to web content. A use-after-free condition occurs when the component continues to reference heap memory after it has been freed. An attacker who crafts specific WebGPU API call sequences can manipulate object lifetimes, triggering access to dangling pointers. This dangling reference enables heap corruption that an attacker can shape into a controllable primitive. Because Dawn runs in the GPU process, successful exploitation can compromise the process boundary that Chrome relies on for sandboxing graphics operations.
Root Cause
The root cause is improper object lifetime management within Dawn's WebGPU resource handling. When a referenced GPU object is released without invalidating all outstanding references, subsequent operations dereference freed memory. This pattern is classified under CWE-416 and is common in C++ components that manage complex graphics resource graphs.
Attack Vector
Exploitation is network-based and requires user interaction. A victim must load a malicious or compromised HTML page that issues crafted WebGPU calls through the Dawn implementation. No authentication is required. The attack complexity is high because the attacker must groom the GPU process heap to align freed and reused allocations. Refer to the Google Chrome Update Blog and the Chromium Issue Tracker Entry for vendor-published context.
No verified public proof-of-concept code is available. Technical exploitation details are restricted by Chromium's standard disclosure policy.
Detection Methods for CVE-2024-9960
Indicators of Compromise
- Unexpected GPU process crashes (gpu_process) on endpoints running outdated Chrome builds
- Browser child process termination with heap corruption signatures in crash dumps
- Outbound connections from Chrome to untrusted domains immediately preceding GPU process instability
Detection Strategies
- Inventory installed Chrome versions across managed endpoints and flag builds earlier than 130.0.6723.58
- Monitor Windows Event Log, macOS unified logs, and Linux syslog for repeated Chrome GPU process crashes
- Correlate browser process anomalies with recent navigation events to identify suspicious page visits
Monitoring Recommendations
- Enable telemetry collection from browsers and forward to a centralized log platform for version and crash analysis
- Track WebGPU feature usage if available through enterprise browser reporting
- Alert on anomalous child process spawns from chrome.exe following crashes
How to Mitigate CVE-2024-9960
Immediate Actions Required
- Update Google Chrome to version 130.0.6723.58 or later on all endpoints
- Restart browsers after patch deployment to ensure the vulnerable Dawn binary is unloaded
- Verify Chromium-based browser vendors (Edge, Brave, Opera, Vivaldi) have shipped corresponding fixes and update accordingly
Patch Information
Google released the fix in the Stable Channel update for desktop on October 15, 2024. Details are published in the Google Chrome Update Blog. The corresponding Chromium issue is tracked at the Chromium Issue Tracker Entry. Enterprise administrators should deploy the update through standard browser management channels such as Chrome Browser Cloud Management or group policy.
Workarounds
- Disable WebGPU via the chrome://flags/#enable-unsafe-webgpu flag or enterprise policy where the feature is not required
- Restrict browsing to trusted sites using enterprise web filtering until patching completes
- Apply the WebGpuExtensionsEnabled and related enterprise policies to limit attack surface where supported
# Verify Chrome version on Windows endpoints via PowerShell
(Get-Item "C:\Program Files\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion
# Verify Chrome version on macOS / Linux
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version
google-chrome --version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
