CVE-2024-7256 is an insufficient data validation flaw in Dawn, the WebGPU implementation used by Chrome. It is scored 8.8 (High) and affects Chrome on Android before 127.0.6533.88. A crafted web page could run code. Update Chrome to 127.0.6533.88 or later.
What's affected
The record states that insufficient data validation in Dawn in Google Chrome on Android, prior to 127.0.6533.88, allowed a remote attacker to execute arbitrary code via a crafted HTML page. Its product list names Chrome and Android. Google marks the issue High in the Chromium severity scale, and the NVD score of 8.8 agrees.
Google's release notes for the 30 July 2024 stable update list this bug as "High CVE-2024-7256: Insufficient data validation in Dawn", reported by a researcher using the handle gelatin dessert on 23 July 2024, tracked as Chromium issue 354748060. The same update fixed a separate Dawn bug, CVE-2024-6990, which Google rates Critical. That is a different CVE, so do not read its severity into this one.
Note a mismatch in how the sources frame scope. The record limits this CVE to Chrome on Android. The release notes page we fetched is the desktop channel post, and it lists the bug among the fixes in that build. Android builds have their own release notes, so confirm the exact Android version there. The fixed version in the record is 127.0.6533.88.
The weakness is mapped to CWE-345, insufficient verification of data authenticity. The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
How to check if you're exposed
- On an Android device, open Chrome, then Settings, then About Chrome. The version shown must be 127.0.6533.88 or higher.
- For managed devices, use your mobile device management console to report Chrome package versions across the fleet and filter for older builds.
- Check Google Play for a pending Chrome update on test devices and shared tablets that rarely get opened.
- Remember that other apps embed web content. Android WebView is updated separately through Play, so review it as well when it appears in your management reports.
- If you only run Chrome on desktop, the record does not list you for this specific CVE, but the same 127.0.6533.88 update fixed related bugs, so update anyway.
What to do now
- Update Chrome on every Android device to 127.0.6533.88 or later from Google Play.
- Set your mobile management policy to require a minimum Chrome version, and mark devices below it as noncompliant.
- Update desktop Chrome in the same pass, since the release included other security fixes.
- Restart the browser after updating. Open tabs keep running old code until relaunch.
- Add the Chrome version to the asset record for devices that handle company data.
Why it matters
Dawn translates web graphics and compute calls into the work a device's graphics drivers do. It receives complex data from untrusted web content, so it has to check every input. When validation is missing, a page may be able to push the process into unsafe behavior. The record's claim is code execution, which is why the impact is scored high on confidentiality, integrity and availability.
Browsers are exposed to untrusted content every day, which is why fixes for this kind of bug arrive on a steady schedule. The CVE is not in the CISA Known Exploited Vulnerabilities catalog, and the release notes do not say it was used in attacks. Plan it as a prompt update, not an incident.
Quick check
Is CVE-2024-7256 the same as CVE-2024-6990?
No. Both are Dawn bugs fixed in Chrome 127.0.6533.88, but they are separate CVEs. Google rates CVE-2024-6990 Critical and this one High.
Which version fixes it?
127.0.6533.88 per the record. Confirm the Android build number against Google's Android release notes.
Sources
Use the free in-browser scan at gold.safeguard.sh/scan for application dependencies, and the Gold directory for related entries.
Last reviewed: 19 October 2026.
