CVE-2024-3176 is a high severity (CVSS 8.8) out of bounds write in SwiftShader, the software graphics renderer in Google Chrome. Builds before 117.0.5938.62 are affected. The fix shipped in September 2023, so update Chrome to 117.0.5938.62 or later and confirm the version on managed devices.
What's affected
Google Chrome prior to 117.0.5938.62. The Chrome Releases post (its URL places it in September 2023) lists this CVE as a High item in SwiftShader. The NVD record applies to Chrome without other version bounds.
The record says a remote attacker could perform an out of bounds memory write via a crafted HTML page. The vector requires user interaction, which in practice means visiting or opening attacker controlled content.
Publication was in July 2024, well after the fix, so current browsers already include it.
The weakness class: CWE-787, out of bounds write. The NVD record scores it 8.8 (high) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. CISA Known Exploited Vulnerabilities status in the record: not listed.
How to check if you're exposed
Run chrome://version in the address bar, or google-chrome --version on Linux. Compare the number with the fixed build named above. Managed fleets should check their software inventory or browser management console instead of asking users, because Chrome updates on its own schedule and many machines lag.
What to do now
- Update Chrome to 117.0.5938.62 or later, ideally the current stable release.
- Restart the browser to apply the update.
- Look for long lived Chrome installs on shared, kiosk and lab machines, which tend to miss updates.
- Include Chromium derivatives and embedded engines in the same check.
Why it matters
An out of bounds write, CWE-787, means code wrote data past the end of a buffer. In a graphics renderer that handles content from the web, that is a serious class because the input is untrusted and the component is complex.
The record lists the CWE twice, which is a data quirk and not a second weakness. The lesson for defenders is about speed of update, not about this one component: browsers are the most exposed software on most desktops.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Do I need to do anything if my Chrome auto updates?
Usually only confirm it. Check that the browser is on 117.0.5938.62 or later and has been restarted. Machines that stay powered on with the browser open for weeks can still run an old build.
Sources
- Google Chrome Releases blog, September 2023 stable update
- Chromium issue 40061476 (listed in the record; access may be restricted)
- Safeguard Gold entry for CVE-2024-3176
- Free in-browser dependency scan
Last reviewed: 19 October 2026.
