CVE-2024-3833 is a high severity vulnerability (CVSS 8.8) in Google Chrome. Object corruption in WebAssembly could let a remote attacker exploit object corruption through a crafted HTML page. Chrome 124.0.6367.60 or later, per the record. Below you will find the affected versions, how to check your exposure, and a short list of steps to take now.
What's affected
- Google Chrome prior to 124.0.6367.60, according to the record.
- The record's product data also lists Fedora 38 and 39 for the related distribution updates.
Severity in the record: High, CVSS 8.8, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. In plain terms: over the network, no privileges required, user interaction required. Weakness class: CWE-374, passing mutable objects to an untrusted method.
Fixed version: Chrome 124.0.6367.60 or later, per the record. The Chrome Releases stable channel post from 16 April 2024 is the reference.
The record's KEV flag is false, so this CVE is not in the CISA Known Exploited Vulnerabilities catalog, and no source reviewed here reports exploitation in the wild.
How to check if you're exposed
- Open chrome://version in the browser and read the version number.
- On Linux, check the packaged version:
google-chrome --version. - Use Help, About Google Chrome to trigger an update, then relaunch the browser.
What to do now
- Update to the fixed version and restart the application so the new build is actually running.
- Keep automatic updates enabled.
- Record the decision in your tracker with the CVE id and the date, so the next audit can see what you did about CVE-2024-3833.
Why it matters
A use after free bug is a memory safety error. The program releases a block of memory, keeps a pointer to it, and later uses that pointer. By then the memory may hold something else, so the program can read or write data it does not own. In a browser, bugs like this are a common route to code execution, which is why they are patched quickly.
WebAssembly lets pages run compiled code at near native speed in a sandbox. A corruption bug in its implementation is reachable from a web page. Other browsers built on Chromium ship their own updates, so check each vendor for the fixed build rather than assuming it came with Chrome.
Look up the entry on Gold to see how it connects to other advisories, and use reachability analysis to separate the components that actually call vulnerable code from the ones that merely sit in your inventory.
Quick check
Does this need a download?
No. The record says a crafted HTML page is enough, so loading the page in an unpatched browser is the exposure.
Is CVE-2024-3833 in the CISA KEV catalog?
No. The record's KEV flag is false.
Sources
These links come from the NVD record. They were not retrievable when this post was written, so the details above rest on the record text. Check them before you act.
Last reviewed: 19 October 2026.
