CVE-2024-5845 is a use after free in the Audio component of Google Chrome. The record scores it High (CVSS 8.8) and says a crafted PDF file could potentially lead to heap corruption, while Chromium rated it Medium. Update to Chrome 126 or later and relaunch.
What's affected
- Product: Google Chrome, with Fedora 39 and 40 in the record.
- Fixed versions: The Chrome release post says 126.0.6478.54 for Linux and 126.0.6478.56/57 for Windows and Mac, and says the 126.0.6478.56/57 build also went to the extended stable channel. The record says only "prior to 126.0.6478.54". Both are given here because the numbers differ by platform.
- Severity conflict: record High at 8.8, release post Medium.
- Trigger per the record: a crafted PDF file. The release post names only the Audio component.
- Exploitation: KEV flag false.
How to check if you're exposed
Open chrome://version in the browser, or run one of these from a shell. You want 126.0.6478.54 or later on Linux, and 126.0.6478.56 or later on Windows and Mac.
# Linux
google-chrome --version
# Fedora, if you use the distribution package
rpm -q chromium
# macOS
"/Applications/Google Chrome.app/Contents/MacOS/Google Chrome" --version
# Windows PowerShell
(Get-Item "C:\Program Files\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion
The record ties this to a PDF file, which is unusual for an audio component, and the release post does not explain why.
What to do now
- Update Chrome to 126.0.6478.54 or later on Linux, or 126.0.6478.56 or later on Windows and Mac, then relaunch it. The fix does not apply until the browser restarts.
- Check Chromium-based browsers and anything that embeds Chromium separately. Each vendor ships the fix on its own schedule, so look for that vendor's advisory.
- On managed devices, confirm your update policy has not pinned an older version, and check that users actually relaunched.
- Record the result in your asset inventory so the next browser release is easier to audit.
Why it matters
The record maps this to CWE-416, use after free. The release post lists the component as Audio and the reporter as anonymous. Bug details were restricted.
The PDF wording in the record deserves care. It sits beside two PDFium entries, CVE-2024-5846 and CVE-2024-5847, which share the same phrase, so the text may have been carried over. I cannot confirm from what I read how a PDF reaches the audio code. If you want to reduce exposure to hostile PDFs while you roll out the update, opening untrusted PDFs in a separate viewer is a reasonable stopgap, though that is general hardening and not advice from Chromium.
Whatever the exact route, the fix is the same build as the others.
Quick check
Does it involve PDF files or audio?
The record says a crafted PDF file and the release post says Audio. They are both quoted here because the sources do not explain the link.
Is there a workaround?
None is documented in the sources. Update Chrome. Avoiding untrusted PDFs is general caution only.
Sources
- Chrome Releases: Stable Channel Update for Desktop, 11 June 2024
- Safeguard Gold entry for CVE-2024-5845
Last reviewed: 19 October 2026.
