CVE-2024-2627 is a use after free in Canvas in Google Chrome before 123.0.6312.58, scored High at 8.8 by NVD though Chromium rates it Medium, fixed in 123.0.6312.58. Severity is High at 8.8. Update Chrome to 123.0.6312.58 or later. The sections below cover affected versions, checks and next steps.
What's affected
- Google Chrome before 123.0.6312.58 is affected.
- The Chrome release post of 19 March 2024 lists the fix and rates the issue Medium.
- The NVD record scores it 8.8 and High. Both are in the sources, and the gap comes from different scoring methods.
- Fedora 38, 39 and 40 appear in the record because they package Chromium.
The NVD record gives a CVSS score of 8.8 with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. Published 2024-03-20.
How to check if you're exposed
- Open chrome://version and read the version number.
google-chrome --versionprints it on Linux.rpm -q chromiumshows the packaged version on Fedora.- For other Chromium browsers, read the vendor's release notes to find the included Chromium version.
What to do now
- Update Chrome to 123.0.6312.58 or later and restart it.
- Update Chromium packages from your distribution.
- Check desktop apps that bundle Chromium.
- Confirm the version across managed devices.
If this software reaches you as part of something you build, the free in-browser dependency scan at gold.safeguard.sh/scan lists known vulnerabilities in your manifests, and reachability analysis helps you see which ones your code can actually trigger.
Why it matters
A use after free means memory is used after it has been released, and this one is in Canvas, the component that draws graphics for web pages. A crafted page could cause heap corruption, per the record. Chromium's own rating is Medium, because browser sandboxing and other layers limit what a single bug gives an attacker. NVD's generic scoring gives a High number. Neither says the bug was used in attacks.
The record tags the weakness as CWE-416. See the Gold pages for more on the class.
The record's Known Exploited Vulnerabilities flag is false, so CISA has not listed it as exploited.
When ratings differ, patch on the faster of the two timelines. A browser update is cheap and the fix lands anyway.
It helps to separate severity from urgency. A medium vendor rating means the vendor sees layers that limit damage, such as the sandbox. It does not mean waiting is free. Browser updates are low cost and low risk compared with most patches, so the sensible policy is to apply them promptly and spend triage effort on software where patching is hard.
Quick check
Why do the two severity ratings differ?
Chromium rates issues by its own impact model and calls this one Medium. NVD scores with the generic CVSS method and lands at 8.8. Use the update guidance either way.
Sources
Last reviewed: 19 October 2026.
