CVE-2024-5834 is a High (CVSS 8.8) flaw in Dawn, the WebGPU component of Google Chrome. Google describes it as an inappropriate implementation that let a remote attacker execute arbitrary code through a crafted HTML page. Chrome 126 contains the fix, so update and relaunch.
What's affected
- Product: Google Chrome, with Fedora 39 and 40 named in the record.
- Fixed versions: The Chrome release post says 126.0.6478.54 for Linux and 126.0.6478.56/57 for Windows and Mac, and says the 126.0.6478.56/57 build also went to the extended stable channel. The record says only "prior to 126.0.6478.54". Both are given here because the numbers differ by platform.
- Severity: High, CVSS 8.8. The Chromium rating is also High.
- Weakness class: the record uses CWE-94, code injection, which differs from the use after free entries on the neighbouring Dawn CVEs.
- Exploitation: KEV flag false.
How to check if you're exposed
Start with the version string. Because this one is described as code execution rather than memory corruption, treat it as a priority within the 126 update.
# Linux
google-chrome --version
# Fedora, if you use the distribution package
rpm -q chromium
# macOS
"/Applications/Google Chrome.app/Contents/MacOS/Google Chrome" --version
# Windows PowerShell
(Get-Item "C:\Program Files\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion
For a fleet, pull the same string from your endpoint management tool and filter for anything older than the 126 build for its platform.
What to do now
- Run the browser update and relaunch. If you manage a fleet, push the 126 build through your usual software distribution channel.
- List the browsers and embedded Chromium runtimes in your estate. Desktop apps that bundle their own Chromium are not fixed by a Chrome update.
- Confirm extended stable users received 126.0.6478.56/57, which the release post says was pushed to that channel.
- Keep automatic updates on. Browser fixes are small and frequent, and delay is the main risk.
Why it matters
The record maps this to CWE-94, improper control of code generation. That is an unusual label for a browser bug. The Chromium wording, "inappropriate implementation", is a general category the team uses when behaviour does not match the intended design, and it covers logic errors as well as memory errors.
The record and release post stop short of saying how the flaw works, and bug details were restricted. What they do say is enough to act on: code execution from a web page, no privileges needed, one click or page visit. Patch quickly, and do not wait for a public write up.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Why is this labelled code injection and not memory corruption?
The record maps it to CWE-94. Google calls it an inappropriate implementation, which is a broad category. Details were restricted at release, so the exact mechanism is not public in what I read.
Is it exploited in the wild?
The record sets the KEV flag to false and the release post does not say it is. Check the CISA catalog for changes.
Sources
- Chrome Releases: Stable Channel Update for Desktop, 11 June 2024
- Safeguard Gold entry for CVE-2024-5834
Last reviewed: 19 October 2026.
