CVE-2024-7255 is an out of bounds read in the WebTransport component of Google Chrome, scored 8.8 (High). Chrome versions before 127.0.6533.88 are affected. A crafted web page can trigger it. The fix shipped in the stable channel update of 30 July 2024, so update to 127.0.6533.88 or later.
What's affected
The record says Chrome prior to 127.0.6533.88 is affected, and that a remote attacker could potentially perform out of bounds memory access through a crafted HTML page. Google rates the bug High on its own Chromium severity scale, and the NVD score of 8.8 lands in the same band.
From Google's release notes for the stable channel update: the desktop channel moved to 127.0.6533.88 or .89 for Windows and Mac, and 127.0.6533.88 for Linux. Google credits the report to Marten Richter and gives the report date as 13 July 2024. The tracking entry is Chromium issue 352872238, which may stay restricted until most users have updated.
A detail worth knowing: the release notes were revised on 20 November 2025 to correct the list of security fixes in that build. The bug appears in the corrected list as "High CVE-2024-7255: Out of bounds read in WebTransport". If you saved an older copy of the notes, check the current page.
The weakness class is CWE-125, out of bounds read. The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, meaning it travels over the network, needs no privileges, and needs the user to load a page.
How to check if you're exposed
- Open
chrome://versionin Chrome and read the first line. Anything below 127.0.6533.88 is affected. - For managed fleets, pull the Chrome version from your endpoint management tool or the browser reporting in the Google Admin console, and filter for versions lower than the fixed build.
- Do not forget Linux workstations, build agents and kiosk machines that run Chrome without anyone watching the update prompt.
- Other Chromium based browsers take their fixes from upstream on their own schedule. Check each vendor's release notes for the Chromium version they ship.
- Headless Chrome used in CI, scrapers or PDF rendering counts too. Look for pinned images or packages.
What to do now
- Update Chrome to 127.0.6533.88 or later and restart the browser. Updates download in the background but do not apply until restart.
- Use your management tooling to force a relaunch after a grace period on managed devices.
- Rebuild container images and VM templates that bundle Chrome or Chromium, then redeploy.
- Track Edge, Brave, Opera and any Electron apps in your estate, and update them as their vendors ship the matching Chromium build.
- Record the browser version in your asset inventory so the next Chrome advisory is a query, not a hunt.
Why it matters
A read past the end of a buffer lets code see memory it should not. In a browser, memory beside the buffer can hold data from other pages or the internal state of the process. Memory safety flaws like this are the most common serious class in browser engines, and the fix is usually a bounds check.
WebTransport is a protocol for low latency data over HTTP/3, handled by a network facing component. That is why the attack vector is the network and the only user action needed is visiting a page. The record says nothing about exploitation, the CVE is not in the CISA Known Exploited Vulnerabilities catalog, and the release notes do not flag it as exploited. That makes it a patch within your normal fast cycle item, not an emergency by itself.
Quick check
Does this affect Chrome on Android and iOS?
The record names Chrome prior to 127.0.6533.88 without limiting the platform. The release notes fetched cover the desktop channel, so check Google's separate Android release notes for the mobile build number.
Is a browser restart really needed?
Yes. Chrome downloads the update in the background, but the running process keeps using the old code until it is relaunched.
Sources
The free in-browser dependency scan at gold.safeguard.sh/scan covers application dependencies, and the Gold directory lists related browser advisories.
Last reviewed: 19 October 2026.
