CVE-2024-1284 is a use after free in Mojo, the inter-process messaging layer in Google Chrome. NVD scores it 9.8 Critical, while Chromium labels it High. Chrome versions before 121.0.6167.160 are affected and that build fixes it. Update Chrome and restart the browser.
What's affected
The record says Chrome prior to 121.0.6167.160 allowed a remote attacker to potentially exploit heap corruption through a crafted HTML page. Chrome Releases says the Stable channel moved to 121.0.6167.160 for Mac and Linux and 121.0.6167.160 or 161 for Windows, rolling out over days to weeks.
The sources disagree on the label. NVD scores it 9.8 Critical. The Chrome Releases post lists CVE-2024-1284 as High, and the description in the record says Chromium security severity High. I report both and do not pick one.
The same update fixed CVE-2024-1283, a heap overflow in Skia, and the post lists three security fixes in total. The record also references Fedora package announcements, so Linux distributions that package Chromium follow their own schedule.
Weakness class: CWE-416. The NVD record carries the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H and a score of 9.8.
How to check if you're exposed
In Chrome, open the menu, then Help, then About Google Chrome. The version must be 121.0.6167.160 or later.
On Linux:
google-chrome --version
For Chromium based browsers and apps that embed Chromium, look at each vendor's release notes. The Chrome version number alone does not tell you about their builds.
Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan for the libraries in your own projects, and reachability analysis helps you tell which findings your code actually calls.
What to do now
- Update Chrome to 121.0.6167.160 or later.
- Restart the browser so the new build is running.
- Push the update through device management for fleets and report on versions.
- Apply Fedora or other distribution updates for packaged Chromium.
- Review embedded Chromium in desktop apps used in your company.
Why it matters
A use after free (CWE-416) happens when code keeps using memory after it has been released. The memory may then hold other data, so the program can behave in ways its authors did not intend. Mojo carries messages between Chrome processes, so a fault there sits near the boundary the sandbox depends on.
The record's KEV flag is false and the Chrome post I read does not report exploitation. The vendor label of High and the 9.8 from NVD describe the same bug differently, so use your own policy to decide urgency. For a browser, same week patching is a sensible default.
Quick check
How does this differ from CVE-2024-1283?
Both were fixed in 121.0.6167.160. CVE-2024-1283 is a heap overflow in Skia and CVE-2024-1284 is a use after free in Mojo.
Do I need to restart Chrome?
Yes. The fix applies only after the browser relaunches on the new build.
Sources
Last reviewed: 19 October 2026.
