CVE-2024-2885: Use after free in Dawn

Reference Links

• https://chromereleases.googleblog.com/2024/03/stable-channel-update-for-desktop_26.html (Advisory)
• https://issues.chromium.org/issues/328958020
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-2885 (Advisory)
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3YUWGSMA5X2NQP5XEFCLRWNX6246GZ2C/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/G3RKI7VTQSIAI3PVZGRCHOSELTQXQ5FQ/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IQMRHKDEG4J7TMRRRGUGW6GS4MVBX5IT/

Parent vulnerabilities

(Appears in the following advisories)

• 6721886098116498662

Peer vulnerabilities

(Found alongside the following vulnerabilities)

• CVE-2024-2883
• CVE-2024-2886
• CVE-2024-2887

Frequently Asked Questions

• What is the severity of CVE-2024-2885?

  CVE-2024-2885 has been classified with a high severity level due to its potential for exploitation in affected software.

• How do I fix CVE-2024-2885?

  To fix CVE-2024-2885, update your Google Chrome to version 123.0.6312.86 or later, or ensure your Microsoft Edge (Chromium-based) is updated to the latest version.

• Which software is affected by CVE-2024-2885?

  CVE-2024-2885 affects Google Chrome versions prior to 123.0.6312.86 and the various versions of Microsoft Edge that utilize a Chromium-based engine.

• Is there a workaround for CVE-2024-2885?

  There is no known workaround for CVE-2024-2885; the recommended solution is to apply the necessary updates to the affected software.

• What type of vulnerability is CVE-2024-2885?

  CVE-2024-2885 is identified as a 'use after free' vulnerability, which can lead to potential exploitation by attackers.