CVE-2024-1059 is a High severity use after free, scored 8.8, in the Peer Connection component of Google Chrome. The record says versions prior to 121.0.6167.139 are affected. Update Chrome to 121.0.6167.139 or later and restart the browser so the new build is running.
What's affected
The record lists Google Chrome prior to 121.0.6167.139. It also lists Fedora 38 and 39, whose package announcements are among the references, since Fedora ships Chromium builds. Chromium rated the issue High.
The Chrome Releases post for 30 January 2024 is the primary advisory, but its page body returned only navigation when I fetched it, so I cannot quote the per platform build numbers. Use the version in the record as the floor and check the release notes for your platform.
How to check if you're exposed
Open chrome://version in Chrome and read the first line. Anything older than 121.0.6167.139 is affected. You can also open the Chrome menu, then Help, then About Google Chrome, which checks for updates and prompts you to relaunch.
For managed fleets, ask your endpoint tooling to report the installed Chrome version and compare it to the floor. On Linux you can read the installed package version with your package manager. Other Chromium based browsers ship their own builds on their own schedule, so check their vendor notes.
What to do now
- Read the Chrome version on each machine and find any below 121.0.6167.139.
- Update Chrome and restart it. An update that is downloaded but not relaunched does not protect you.
- For managed fleets, push the update through your device management and report on relaunch status.
- Check Chromium based browsers and embedded builds such as Electron apps that you ship or rely on, since they update separately.
- On Fedora 38 and 39, follow the Fedora package announcement for the Chromium update.
Why it matters
A use after free means code keeps using memory after it has been released. In the browser, that memory can be reused by an attacker controlled object, which turns a crash into corruption of memory the attacker can influence.
The class is use after free, CWE-416. Per the record, a remote attacker could potentially exploit stack corruption via a crafted HTML page. Peer Connection is the part of the browser that handles real time audio and video connections (WebRTC), so it is reachable from ordinary web pages.
The record's KEV flag is false and I found no statement of exploitation in the sources I could read.
Quick check
Which Chrome version fixes CVE-2024-1059?
The record says versions prior to 121.0.6167.139 are affected, so 121.0.6167.139 or later. Check the Chrome Releases notes for your platform's exact build.
Do I need to restart Chrome?
Yes. The browser must relaunch into the updated build before the fix is active.
Sources
- Chrome Releases, stable channel update for desktop, 30 January 2024 (page body could not be read when fetched)
- Chromium bug 1514777
- NVD record and references for CVE-2024-1059
Last reviewed: 19 October 2026.
