CVE-2024-1283 is a heap buffer overflow in Skia, the graphics library inside Google Chrome. NVD scores it 9.8 Critical, while Chromium's own label is High. Chrome versions before 121.0.6167.160 are affected, and that release fixes it. Update Chrome and restart the browser.
What's affected
The record says Chrome prior to 121.0.6167.160 allowed a remote attacker to potentially exploit heap corruption through a crafted HTML page. The Chrome Releases post of 6 February 2024 says the Stable channel moved to 121.0.6167.160 for Mac and Linux and 121.0.6167.160 or 161 for Windows, rolling out over days to weeks.
Severity differs between sources. NVD gives 9.8 Critical with the vector shown below. The Chrome Releases post lists CVE-2024-1283 as High, and the record's own description repeats Chromium security severity High. Both are correct in their own scheme, since NVD scores the generic effect and Chromium rates by its own sandbox aware criteria.
The same post lists three security fixes in this update. This guide covers CVE-2024-1283 only. Its sibling, CVE-2024-1284, is a use after free in Mojo fixed in the same build. The record also lists Fedora, whose package announcements are cited as references, so Linux distribution packages of Chromium follow their own update schedule.
Weakness class: CWE-787, CWE-122. The NVD record carries the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H and a score of 9.8.
How to check if you're exposed
In Chrome, open the menu, then Help, then About Google Chrome. The page shows the version and starts the update. You need 121.0.6167.160 or later.
From a terminal on Linux:
google-chrome --version
Fleet managers can read the browser version from their device management console. Other Chromium based browsers, and apps that embed Chromium, ship on their own timetable, so check each vendor's notes.
Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan for the libraries in your own projects, and reachability analysis helps you tell which findings your code actually calls.
What to do now
- Update Chrome to 121.0.6167.160 or later on every desktop.
- Restart the browser, because an update that is downloaded but not applied does not protect you.
- For managed fleets, push the update through your device management tool and report on the version.
- Update Linux Chromium packages from your distribution, using the Fedora or other distribution announcements.
- Check embedded Chromium in other apps and plan for their updates.
Why it matters
A heap buffer overflow (CWE-122, under CWE-787) means code writes past the end of a block of memory on the heap. Skia draws web pages, so a crafted page can feed it unexpected data. Memory corruption bugs like this are what browser sandboxes are built to contain.
The record's KEV flag is false and the Chrome Releases text I read does not report exploitation. The rating gap is the reason to read both numbers. Even with a High from Chromium, a drive by exposure through ordinary browsing makes quick patching worthwhile.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is this Critical or High?
NVD scores it 9.8, which is Critical. Chromium's label is High. Both appear in the sources, so I report both.
Is CVE-2024-1283 exploited in the wild?
The record's KEV flag is false and the Chrome post I read did not say so.
Sources
Last reviewed: 19 October 2026.
