CVE-2024-3834 is a high severity vulnerability (CVSS 8.8) in Google Chrome. Use after free in the Downloads component could let a remote attacker exploit heap corruption through a crafted HTML page. Chrome 124.0.6367.60 or later, per the record. Below you will find the affected versions, how to check your exposure, and a short list of steps to take now.
What's affected
- Google Chrome prior to 124.0.6367.60, according to the record.
- The record's product data also lists Fedora 38 and 39 for the related distribution updates.
Severity in the record: High, CVSS 8.8, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. In plain terms: over the network, no privileges required, user interaction required. Weakness class: CWE-416, use after free.
Fixed version: Chrome 124.0.6367.60 or later, per the record. The Chrome Releases stable channel post from 16 April 2024 is the reference.
The record's KEV flag is false, so this CVE is not in the CISA Known Exploited Vulnerabilities catalog, and no source reviewed here reports exploitation in the wild.
How to check if you're exposed
- Open chrome://version in the browser and read the version number.
- On Linux, check the packaged version:
google-chrome --version. - Use Help, About Google Chrome to trigger an update, then relaunch the browser.
What to do now
- Update to the fixed version and restart the application so the new build is actually running.
- Keep automatic updates enabled.
- Record the decision in your tracker with the CVE id and the date, so the next audit can see what you did about CVE-2024-3834.
Why it matters
A use after free bug is a memory safety error. The program releases a block of memory, keeps a pointer to it, and later uses that pointer. By then the memory may hold something else, so the program can read or write data it does not own. In a browser, bugs like this are a common route to code execution, which is why they are patched quickly.
The Downloads component manages file downloads in the browser. A use after free there can corrupt heap memory. Other browsers built on Chromium ship their own updates, so check each vendor for the fixed build rather than assuming it came with Chrome.
Look up the entry on Gold to see how it connects to other advisories, and use reachability analysis to separate the components that actually call vulnerable code from the ones that merely sit in your inventory.
Quick check
What is heap corruption?
It means memory used for dynamic data has been overwritten in ways the program did not intend, which attackers try to turn into control.
Is CVE-2024-3834 in the CISA KEV catalog?
No. The record's KEV flag is false.
Sources
These links come from the NVD record. They were not retrievable when this post was written, so the details above rest on the record text. Check them before you act.
Last reviewed: 19 October 2026.
