CVE-2024-4368 is a High (CVSS 8.8) use after free in Dawn, the WebGPU implementation in Google Chrome before 124.0.6367.118. A crafted HTML page could corrupt heap memory. Update Chrome to 124.0.6367.118 or later and restart. The same release fixes CVE-2024-4331.
What's affected
- Product: Google Chrome for desktop. Fedora 38 and 39 appear in the record through their Chromium packages.
- Affected versions: before 124.0.6367.118.
- Fixed version: 124.0.6367.118 (Linux, plus Extended Stable on Mac and Windows) and 124.0.6367.119 on Windows and Mac stable, per the Chrome Releases post.
- Component: Dawn, the open source library Chrome uses to implement WebGPU.
- Severity: Chrome rates it High and NVD scores it 8.8, so they agree.
- Exploitation: KEV is false, and the Chrome post does not say it is exploited. The post shows the reward as to be determined at that time.
How to check if you're exposed
Check the version at chrome://version. Below 124.0.6367.118 means exposed. Because Dawn is shared by projects other than Chrome, also look at any Chromium based software that ships its own copy of the engine, such as desktop apps built on Electron. Those get the fix only when their makers update.
For Linux packages, use your distribution's package query for chromium and compare it with the vendor advisory.
What to do now
- Update Chrome and relaunch it.
- Verify the version across managed devices and push the update where it is missing.
- Ask vendors of Electron or other Chromium based apps you rely on when they will ship the fix.
- If your policy allows, disable WebGPU on high risk machines until updates land. Check Chrome's enterprise policy documentation for the exact setting.
- Record the update in your vulnerability tracker with the Chrome version as evidence.
Why it matters
The record maps this to CWE-416, use after free. Dawn translates web graphics calls into work for the graphics processor, so it handles complex objects whose lifetimes are easy to get wrong. When code uses an object after it is freed, memory can be corrupted.
Graphics and media components are frequent sources of these bugs because they process rich, untrusted data at high speed. That makes timely browser updates the main defense.
Quick check
What is Dawn?
Dawn is the library Chrome uses to implement WebGPU, the web's interface to graphics hardware.
Is this the same bug as CVE-2024-4331?
No. They are different use after free flaws in different components, fixed in the same Chrome release.
Scan your own dependencies
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan checks a manifest against known advisories, and the Gold directory keeps this record's details in one place.
Sources
The NVD record for CVE-2024-4368 (published 2024-05-01) supplied the description, score and weakness data. Pages marked fetched were read for this post. The others are listed in the record and were not read.
Last reviewed: 19 October 2026.
