CVE-2024-6990 is an uninitialized use in Dawn, the WebGPU layer of Google Chrome on Android. NVD scores it high (8.8) while Chromium rates it critical. The fixed build is 127.0.6533.88. Update Chrome on Android and relaunch it.
What's affected
The record lists Google Chrome on Android prior to 127.0.6533.88, with the impact described as potential out of bounds memory access through a crafted HTML page. The Chrome Releases post of 30 July 2024 for the 127.0.6533.88 and .89 desktop update lists the bug as Critical, bug 353034820, reported on 15 July 2024. That post says the update carried 4 security fixes. It also carries a correction note dated 20 November 2025, which added a fix that the original notes had left out. If you cached the first version of the post, reread it.
Here is the severity conflict. Chromium calls this Critical. NVD's CVSS 3.1 score is 8.8, which lands in the High band, from the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. Both are published, so plan around the more cautious Critical label. The record does not flag exploitation in the wild and the CVE is not in the CISA KEV catalog.
The weaknesses are CWE-457, use of an uninitialized variable, and CWE-908, use of uninitialized resource. The same release also fixed CVE-2024-7255 and CVE-2024-7256, other high rated bugs in WebTransport and Dawn.
How to check if you're exposed
On Android, open Chrome, then Settings, then About Chrome. The version must be 127.0.6533.88 or newer. In an enterprise, query your mobile management tool for the Chrome package version on each device.
Android WebView is a separate package with its own updates. This record names Chrome, so check WebView through your device vendor or app store listing as a follow up, and do not assume one update covers both.
What to do now
- Update Chrome from Google Play and restart it.
- Make sure managed Android devices are not holding Chrome back through an update policy.
- Check apps that embed WebView for their own guidance.
- Add the Chrome version to your mobile inventory.
- Avoid opening unknown links on devices that cannot update yet.
Why it matters
Dawn is Chrome's implementation of WebGPU, which gives web pages access to graphics hardware. That is a large amount of complex code that reads memory the page can influence. An uninitialized value is a variable that was never set before use, so it holds whatever data happened to be in that memory. If a program uses it to compute a size or an index, the result can be unpredictable and may let code read or write outside a buffer.
Fixes for these bugs are small, but finding them is hard, which is why fuzzing teams keep reporting them in graphics code.
Quick check
Why do two severities appear for this CVE?
Chromium assigns its own rating from impact on the browser. NVD calculates a CVSS score from a vector. They use different methods, so they can differ.
Is desktop Chrome affected?
The record names Chrome on Android. The fix appeared in the desktop 127.0.6533.88 release notes, so keep desktop at that build or later as well.
Sources
- Gold entry for CVE-2024-6990
- Chrome Releases: Stable Channel Update for Desktop, 30 July 2024
- NVD record for CVE-2024-6990
Last reviewed: 19 October 2026.
