CVE-2024-0807 is a high severity (CVSS 8.8) flaw in Web Audio in Google Chrome before 121.0.6167.85. A crafted HTML page could potentially exploit heap corruption. Update Chrome to 121.0.6167.85 or later and restart it. Chromium rated this issue High.
What's affected
Google Chrome prior to 121.0.6167.85. The record names Web Audio as the component. The weakness is a use after free and the record says a crafted HTML page is the trigger.
The fix came in the January 2024 Chrome stable channel update that the record links, along with Fedora and Debian package announcements for downstream builds. Chromium based browsers and distribution packages follow their own schedules, so read their notes.
The record classifies the weakness as CWE-416 (use after free). NVD scores it 8.8 (High) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
The sources differ on severity. NVD's CVSS 3.1 score is 8.8 (High). The Chrome description carries Chromium's own rating, High. Both are published. The fix is the same update either way.
How to check if you're exposed
Open chrome://version in the browser and read the first line. Anything below 121.0.6167.85 on the desktop stable channel is in the range the record describes. Chromium based browsers that track upstream, and Linux distribution packages of Chromium or Chrome, carry their own version numbers and update timing, so check the vendor's package notes as well.
On managed fleets, pull the browser version from your endpoint management tool instead of asking users. A software inventory that records installed browser versions turns this into a query. Knowing what is installed comes before deciding what is exposed.
What to do now
- Update Chrome to 121.0.6167.85 or later, then restart it so the new build is the one running.
- Update Chromium based browsers, Electron apps and embedded browser components that track upstream, and apply the vendor package updates on Linux.
- Enforce automatic browser updates through device management and report browser versions across the fleet.
- Where you cannot update right away, limit browsing on affected machines to trusted sites until you can.
Why it matters
A use after free (CWE-416) means memory is used after release. Because the trigger is a web page, the exposure is a user visiting content an attacker controls, which is why browser patches are the main defense.
Browsers are patched fast. The remaining risk lives in machines that never restart or sit on a pinned version. A fleet wide version report is the cheapest control for that.
The record does not mark this CVE as being in the CISA Known Exploited Vulnerabilities catalog, and nothing in the record says it is exploited in the wild. That can change, so keep it on your watch list.
Try it yourself
When a fixed version exists, the job is finding who still runs the old one. This demo shows how a fix available signal is surfaced against your inventory.
Click through it at your own pace, or open it full screen.
Quick check
Does restarting matter?
Yes. Chrome downloads the update in the background, but the old version keeps running until the browser relaunches.
Sources
The links below are the references listed in the CVE record. The record and its description were the basis for this post, and the vendor advisory remains the authority for fixed versions.
- chromereleases.googleblog.com
- crbug.com
- lists.fedoraproject.org
- lists.fedoraproject.org
- Safeguard Gold entry for CVE-2024-0807
Last reviewed: 19 October 2026.
