CVE-2024-5832 is a High (CVSS 8.8) use after free in Dawn, Chrome's WebGPU component, and the second Dawn bug of that kind fixed in Chrome 126. A crafted HTML page could potentially cause heap corruption. Update to 126 or later and restart the browser.
What's affected
- Product: Google Chrome, plus Fedora 39 and 40 as listed in the record.
- Fixed versions: The Chrome release post says 126.0.6478.54 for Linux and 126.0.6478.56/57 for Windows and Mac, and says the 126.0.6478.56/57 build also went to the extended stable channel. The record says only "prior to 126.0.6478.54". Both are given here because the numbers differ by platform.
- Severity: High in the record (CVSS 8.8) and in the Chromium rating.
- Sibling: CVE-2024-5831, a use after free in the same component, was fixed in the same release.
- Exploitation: KEV flag false, and the release post does not report attacks.
How to check if you're exposed
The quickest check is the About page, chrome://settings/help, which also triggers an update. For scripted checks use one of these:
# Linux
google-chrome --version
# Fedora, if you use the distribution package
rpm -q chromium
# macOS
"/Applications/Google Chrome.app/Contents/MacOS/Google Chrome" --version
# Windows PowerShell
(Get-Item "C:\Program Files\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion
Dawn memory bugs affect everyone running a vulnerable build, regardless of whether they ever use a WebGPU site on purpose.
What to do now
- Apply the Chrome 126 stable update and restart the browser.
- Fedora users on the distribution package should update chromium through the package manager. The record lists Fedora 39 and 40 among affected platforms.
- Audit Chromium-based browsers separately and check each vendor's own security notes for the matching fix.
- After rollout, sample a few machines with the version commands above and confirm the build number.
Why it matters
This one is also CWE-416. The pairing is the useful part. Two use after free bugs in the same component, reported about a week apart according to the release post, suggest the component deserved careful review. Browser teams often find clusters like this once a fuzzer is pointed at a new area.
For defenders, a cluster is a reason to stop reading individual CVE text and track the release. Everything in the 126 stable update, 21 security fixes according to the post, arrives together. Patching to the build number covers all of it, including bugs with no public details yet.
Quick check
Do I need to patch for each CVE separately?
No. One browser update to 126 or later covers every fix in the release. Track the build number, not the individual CVE.
Why does the release post hold back bug details?
The post says access to bug details may stay restricted until most users have updated. That is common practice and gives people time to patch.
Sources
- Chrome Releases: Stable Channel Update for Desktop, 11 June 2024
- Safeguard Gold entry for CVE-2024-5832
Last reviewed: 19 October 2026.
