CVE-2024-2400 is a high severity (8.8) use after free in the Performance Manager component of Google Chrome before 122.0.6261.128. A crafted HTML page could cause heap corruption. Update Chrome and any Chromium based browser to a current stable build. NVD published it on 2024-03-13.
Weakness: CWE-416 (Use After Free).
What's affected
- Affected: Google Chrome before 122.0.6261.128. The record also lists Fedora 38 and 39, which package Chromium.
- Fixed: 122.0.6261.128, per the record.
- Attack conditions:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. Network reachable, no privileges, and a user must open a crafted page. Chromium rated it High.
The record says a remote attacker could potentially exploit heap corruption via a crafted HTML page. We could not read the release post body, so confirm the build number on the Chrome releases blog.
How to check if you're exposed
- In Chrome, open chrome://version and read the version number. Anything below 122.0.6261.128 is affected, though current stable builds are far newer.
- On Linux with Chromium packages, use your package manager, for example
dnf list installed chromiumon Fedora. - For managed fleets, check the browser version report in your device management tool.
- Remember Electron apps and other Chromium embedders ship their own engine and need their own updates.
If you track dependencies, the free in-browser dependency scan can show whether a library or package in your project matches a known CVE. It will not find a standalone PHP application or a firmware image that was never packaged as a dependency, so keep your own inventory of those.
What to do now
- Update Chrome from the About page, then restart the browser so the update applies.
- Update Chromium based browsers and Chromium packages from your distribution.
- For managed fleets, set a minimum browser version and enforce the relaunch.
- Inventory applications that embed Chromium, such as Electron apps, and check each vendor for updates.
- Keep automatic updates enabled.
Why it matters
The record classes this as CWE-416 (Use After Free). A use after free happens when code keeps using memory after it has been released. If an attacker can control what is placed there next, the program can be pushed off course. Browsers are common targets because they render untrusted content all day.
NVD scored it 8.8 (High). The KEV flag is false and the record does not say exploitation was seen.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
What version fixes CVE-2024-2400?
Chrome 122.0.6261.128, per the record.
Is it in the CISA KEV catalog?
The record's KEV flag is false.
Sources
- CVE-2024-2400 record on Safeguard Gold
- NVD description and CVSS vector for CVE-2024-2400, as held in the batch record
- Chrome Releases blog post (page body did not load when fetched)
- Chromium issue 327696052
Last reviewed: 19 October 2026.
