CVE-2024-5831 is a High (CVSS 8.8) use after free in Dawn, the component Chrome uses for WebGPU. A crafted HTML page could potentially exploit heap corruption. Chrome 126, released 11 June 2024, fixes it. Update to that build or newer and relaunch.
What's affected
- Product: Google Chrome, with Fedora 39 and 40 also named in the record.
- Fixed versions: The Chrome release post says 126.0.6478.54 for Linux and 126.0.6478.56/57 for Windows and Mac, and says the 126.0.6478.56/57 build also went to the extended stable channel. The record says only "prior to 126.0.6478.54". Both are given here because the numbers differ by platform.
- Severity: High in both the record (CVSS 8.8) and the Chromium rating.
- Related: CVE-2024-5832 is a second use after free in Dawn fixed in the same release, under a different Chromium bug number. Treat the two as one patching task.
- Exploitation: KEV flag false. The release post does not mention attacks.
How to check if you're exposed
Start with the version string. Because Dawn handles graphics work from web pages, the trigger is a page the user opens. Nothing needs to be installed.
# Linux
google-chrome --version
# Fedora, if you use the distribution package
rpm -q chromium
# macOS
"/Applications/Google Chrome.app/Contents/MacOS/Google Chrome" --version
# Windows PowerShell
(Get-Item "C:\Program Files\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion
For a fleet, pull the same string from your endpoint management tool and filter for anything older than the 126 build for its platform.
What to do now
- Run the browser update and relaunch. If you manage a fleet, push the 126 build through your usual software distribution channel.
- List the browsers and embedded Chromium runtimes in your estate. Desktop apps that bundle their own Chromium are not fixed by a Chrome update.
- Confirm extended stable users received 126.0.6478.56/57, which the release post says was pushed to that channel.
- Keep automatic updates on. Browser fixes are small and frequent, and delay is the main risk.
Why it matters
The record maps this to CWE-416, use after free. The code keeps using a block of memory after it has been released, so what sits there may now belong to something else. An attacker who can influence what gets allocated in that spot may steer later reads or writes, which is why the record speaks of heap corruption.
Dawn matters because it brings GPU programming into the browser. Newer, complex native code that parses input from untrusted pages is a regular source of memory safety bugs, and browsers fix a steady stream of them. Fast updates are the answer, not a one time clean up.
Quick check
What is Dawn?
It is the part of Chrome that implements WebGPU, the web API for graphics and compute. The release post names it as the affected component.
Is CVE-2024-5832 the same bug?
No. It is a separate use after free in Dawn with its own Chromium bug ID, fixed in the same 126 release. Updating once covers both.
Sources
- Chrome Releases: Stable Channel Update for Desktop, 11 June 2024
- Safeguard Gold entry for CVE-2024-5831
Last reviewed: 19 October 2026.
