CVE-2024-6989 is a high severity (CVSS 8.8) use after free in the Loader component of Google Chrome before 127.0.6533.72. A remote attacker could exploit heap corruption through a crafted HTML page. Update Chrome to 127.0.6533.72 or later, which is the first fixed build.
What's affected
Google Chrome on desktop before 127.0.6533.72 (Windows and Mac get 127.0.6533.72 or .73, Linux gets .72). The Chrome Releases post of 23 July 2024 lists the fix among 22 security fixes. It marks the bug High, credits an anonymous reporter, and shows an 8000 dollar reward. The reporter filed it on 25 June 2024, so the fix landed about four weeks later.
The weakness is CWE-416, use after free. The score comes from the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The user interaction part means a person has to load the page. The record does not mark this CVE as exploited in the wild and it is not on the CISA KEV list.
The Loader is the part of the browser that fetches resources for a page, such as scripts, images and documents. Bugs there are interesting because the loader handles hostile network input constantly, and its objects have complicated lifetimes as requests start, redirect and cancel. The public advisory gives no further technical detail, and the Chromium issue (349342289) was restricted at release time.
How to check if you're exposed
Open chrome://version and read the first line. Anything under 127.0.6533.72 is affected. On Linux you can also run:
google-chrome --version
For Chromium based browsers, Chrome's version number is a guide, but each vendor ships on its own schedule. Check that vendor's release notes for the matching fix. Electron apps bundle their own Chromium, so a desktop app built on an old Electron can carry an old browser engine even if Chrome itself is current. Look at the Electron version in each app's about screen or package manifest.
What to do now
- Update Chrome and relaunch it. The update only applies after a restart, and Chrome shows a colored badge on the menu when one is pending.
- Confirm managed machines reached 127.0.6533.72 or later through your endpoint tool.
- Check other Chromium based browsers and Electron apps for their own updates.
- Keep auto update on. Browser fixes arrive weekly, so a manual process falls behind.
Why it matters
Use after free bugs rank among the most common serious flaws in large C++ code bases. Memory is released, a stale reference survives, and later code trusts it. An attacker who controls what lands in that memory can steer the program. Chrome's sandbox limits what a single bug can do, which is why such flaws are often chained with a second bug for a full compromise.
That chaining is a reason to keep every fixed build rolling out quickly, not only ones that are known to be attacked.
Quick check
What is the first fixed version?
127.0.6533.72 for Linux, and 127.0.6533.72 or .73 for Windows and Mac, per the 23 July 2024 stable release notes.
Does the reward amount tell me how bad it is?
No. Rewards reflect the report quality and the program rules. Use the severity and your exposure to set priority.
Sources
- Gold entry for CVE-2024-6989
- Chrome Releases: Stable Channel Update for Desktop, 23 July 2024
- NVD record for CVE-2024-6989
Last reviewed: 19 October 2026.
