CVE-2024-1077 is a High severity use after free, scored 8.8, in the Network component of Google Chrome. The record says versions prior to 121.0.6167.139 are affected. Update Chrome to 121.0.6167.139 or later and restart the browser so the new build is running.
What's affected
The record lists Google Chrome prior to 121.0.6167.139. It also lists Fedora 38 and 39, whose package announcements are among the references, since Fedora ships Chromium builds. Chromium rated the issue High.
The Chrome Releases post for 30 January 2024 is the primary advisory, but its page body returned only navigation when I fetched it, so I cannot quote the per platform build numbers. Use the version in the record as the floor and check the release notes for your platform.
How to check if you're exposed
Open chrome://version in Chrome and read the first line. Anything older than 121.0.6167.139 is affected. You can also open the Chrome menu, then Help, then About Google Chrome, which checks for updates and prompts you to relaunch.
For managed fleets, ask your endpoint tooling to report the installed Chrome version and compare it to the floor. On Linux you can read the installed package version with your package manager. Other Chromium based browsers ship their own builds on their own schedule, so check their vendor notes.
What to do now
- Read the Chrome version on each machine and find any below 121.0.6167.139.
- Update Chrome and restart it. An update that is downloaded but not relaunched does not protect you.
- For managed fleets, push the update through your device management and report on relaunch status.
- Check Chromium based browsers and embedded builds such as Electron apps that you ship or rely on, since they update separately.
- On Fedora 38 and 39, follow the Fedora package announcement for the Chromium update.
Why it matters
The weakness shows up in a component that processes data from outside, so keep the browser current and avoid opening files from untrusted sources while an update is pending.
The class is use after free, CWE-416. Per the record, a remote attacker could potentially exploit heap corruption via a malicious file. The Network component handles web requests and responses.
The record's KEV flag is false and I found no statement of exploitation in the sources I could read.
Quick check
Which Chrome version fixes CVE-2024-1077?
The record says versions prior to 121.0.6167.139 are affected, so 121.0.6167.139 or later. Check the Chrome Releases notes for your platform's exact build.
Do I need to restart Chrome?
Yes. The browser must relaunch into the updated build before the fix is active.
Sources
- Chrome Releases, stable channel update for desktop, 30 January 2024 (page body could not be read when fetched)
- Chromium bug 1511085
- NVD record and references for CVE-2024-1077
Last reviewed: 19 October 2026.
