CVE-2024-3837 is a high severity vulnerability (CVSS 8.8) in Google Chrome. Use after free in QUIC could let a remote attacker who had compromised the renderer process exploit heap corruption through a crafted HTML page. Chrome 124.0.6367.60 or later, per the record.
What's affected
- Google Chrome prior to 124.0.6367.60, according to the record.
- The record's product data also lists Fedora 38 and 39 for the related distribution updates.
Severity in the record: High, CVSS 8.8, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. In plain terms: over the network, no privileges required, user interaction required. Weakness class: CWE-416, use after free.
Fixed version: Chrome 124.0.6367.60 or later, per the record. The Chrome Releases stable channel post from 16 April 2024 is the reference.
Source conflict: Chromium's own note rates this one Medium, while the NVD record scores it 8.8 High. The Chromium rating reflects that a compromised renderer is required first.
The record's KEV flag is false, so this CVE is not in the CISA Known Exploited Vulnerabilities catalog, and no source reviewed here reports exploitation in the wild.
How to check if you're exposed
- Open chrome://version in the browser and read the version number.
- On Linux, check the packaged version:
google-chrome --version. - Use Help, About Google Chrome to trigger an update, then relaunch the browser.
What to do now
- Update to the fixed version and restart the application so the new build is actually running.
- Keep automatic updates enabled.
- Record the decision in your tracker with the CVE id and the date, so the next audit can see what you did about CVE-2024-3837.
Why it matters
A use after free bug is a memory safety error. The program releases a block of memory, keeps a pointer to it, and later uses that pointer. By then the memory may hold something else, so the program can read or write data it does not own. In a browser, bugs like this are a common route to code execution, which is why they are patched quickly.
QUIC is the transport protocol behind HTTP/3. The record says the attacker must already have compromised the renderer process, which makes this a second stage bug in an attack chain. Other browsers built on Chromium ship their own updates, so check each vendor for the fixed build rather than assuming it came with Chrome.
Look up the entry on Gold to see how it connects to other advisories, and use reachability analysis to separate the components that actually call vulnerable code from the ones that merely sit in your inventory.
Quick check
Why is the Chromium severity lower than the NVD score?
Chromium rates it Medium because the attacker needs a compromised renderer first. NVD scores it 8.8, so both views are given here.
Is CVE-2024-3837 in the CISA KEV catalog?
No. The record's KEV flag is false.
Sources
These links come from the NVD record. They were not retrievable when this post was written, so the details above rest on the record text. Check them before you act.
Last reviewed: 19 October 2026.
