CVE-2024-1060

Use after free in Canvas in Google Chrome prior to 121.0.6167.139 allowed a remote attacker to...

8.8 HighFix available

Use after free in Canvas in Google Chrome prior to 121.0.6167.139 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.89%Up 0.8 points since Feb 8, 2024

What each source reports

NVD Score used 8.8

Use after free in Canvas in Google Chrome prior to 121.0.6167.139 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Record: CVE-2024-1060
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-416
Updated: 2026-11-02

CVE List 8.8

Use after free in Canvas in Google Chrome prior to 121.0.6167.139 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Record: CVE-2024-1060
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-416
Updated: 2026-11-02

EUVDEUVD-2024-16835 8.8

Use after free in Canvas in Google Chrome prior to 121.0.6167.139 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Record: EUVD-2024-16835
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-fhq6-2w37-vh8q 8.8

Use after free in Canvas in Google Chrome prior to 121.0.6167.139 allowed a remote attacker to...

Use after free in Canvas in Google Chrome prior to 121.0.6167.139 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Record: GHSA-fhq6-2w37-vh8q
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-416
Updated: 2026-11-02

OSVALPINE-CVE-2024-1060 8.8

Use after free in Canvas in Google Chrome prior to 121.0.6167.139 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Record: ALPINE-CVE-2024-1060
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-03

OSV 8.8

Use after free in Canvas in Google Chrome prior to 121.0.6167.139 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Record: CVE-2024-1060
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Show 5 moreShow less

OSVDEBIAN-CVE-2024-1060 8.8

Use after free in Canvas in Google Chrome prior to 121.0.6167.139 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Record: DEBIAN-CVE-2024-1060
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVopenSUSE-SU-2024:0053-1 No score

Security update for opera

This update for opera fixes the following issues:

Update to 107.0.5045.21
- CHR-9604 Update Chromium on desktop-stable-121-5045 to 121.0.6167.160
- DNA-114167 Crash at TopLevelStorageAccessPermissionContext:: DecidePermission(permissions::PermissionRequestData, base:: OnceCallback)
- DNA-114303 Crash at auto std::__Cr::remove_if(auto, auto, base::ObserverList::Compact()::”lambda”(auto const&))
- DNA-114478 Start Page opening animation refresh
- DNA-114553 Change search box animation
- DNA-114723 [Search box] No option to highlight typed text
- DNA-114806 [Tab cycler] Domain address should be bolded
- DNA-114846 Translations for O107
- DNA-114924 Crash at opera::SuggestionModelBase:: NavigateTo(WindowOpenDisposition)
The update to chromium 121.0.6167.160 fixes following issues: CVE-2024-1283, CVE-2024-1284
Update to 107.0.5045.15
- CHR-9593 Update Chromium on desktop-stable-121-5045 to 121.0.6167.140
- DNA-114421 Animate text in tab cycler from the center of the screen
- DNA-114519 Crash at media::AVStreamToVideoDecoderConfig (AVStream const*, media::VideoDecoderConfig*)
- DNA-114537 Default value for synchronization changed from 'Do not sync data' to 'Customise sync'
- DNA-114554 Add shadow to tab thumbnails in tab cycler
- DNA-114555 Fade out long tab titles
- DNA-114686 [Import] Import from Opera Crypto is marked as done even when Crypto is not installed
- DNA-114691 Update font colors
- DNA-114692 Update shadow (glow) of tabs
- DNA-114693 Update position of text and tabs when cycling through tabs
- DNA-114790 [Linux] Unwanted 1px top border in full screen mode
Complete Opera 107 changelog at: https://blogs.opera.com/desktop/changelog-for-107/
The update to chromium 121.0.6167.140 fixes following issues: CVE-2024-1059, CVE-2024-1060, CVE-2024-1077
Update to 106.0.4998.70
- DNA-112467 Shadow on Opera popups
- DNA-114414 The 'Move to' workspace submenu from tab strip stays blue when its submenu item is selected
Update to 106.0.4998.66
- CHR-9416 Updating Chromium on desktop-stable-* branches
- DNA-114489 Release and update opera:intro extension version in Opera

Record: openSUSE-SU-2024:0053-1
Updated: 2026-11-02

OSVopenSUSE-SU-2024:13758-1 No score

chromedriver-121.0.6167.184-1.1 on GA media

These are all security issues fixed in the chromedriver-121.0.6167.184-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:13758-1
Updated: 2026-11-02

OSVopenSUSE-SU-2024:13766-1 No score

ungoogled-chromium-122.0.6261.111-1.1 on GA media

These are all security issues fixed in the ungoogled-chromium-122.0.6261.111-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:13766-1
Updated: 2026-11-02

OSVopenSUSE-SU-2024:14001-1 No score

libQt5Pdf5-5.15.17-1.1 on GA media

These are all security issues fixed in the libQt5Pdf5-5.15.17-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:14001-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`qt5-qtwebengine` Alpine:v3.19	before 5.15.16-r4	5.15.16-r4
`qt5-qtwebengine` Alpine:v3.20	before 5.15.16-r6	5.15.16-r6
`qt5-qtwebengine` Alpine:v3.21	before 5.15.16-r6	5.15.16-r6
`qt5-qtwebengine` Alpine:v3.22	before 5.15.16-r6	5.15.16-r6
`qt5-qtwebengine` Alpine:v3.23	before 5.15.16-r6	5.15.16-r6
`qt6-qtwebengine` Alpine:v3.19	before 6.6.1-r7	6.6.1-r7
`qt6-qtwebengine` Alpine:v3.20	before 6.6.1-r8	6.6.1-r8
`qt6-qtwebengine` Alpine:v3.21	before 6.6.1-r8	6.6.1-r8
`qt6-qtwebengine` Alpine:v3.22	before 6.6.1-r8	6.6.1-r8
`qt6-qtwebengine` Alpine:v3.23	before 6.6.1-r8	6.6.1-r8

Show 7 moreShow less

Affected packages
Package	Affected	Fixed
`qt6-qtwebengine` Alpine:v3.24	before 6.6.1-r8	6.6.1-r8
`chromium` Debian:12	before 121.0.6167.139-1~deb12u1, plus listed versions 113.0.5672.126-1114.0.5735.106-1114.0.5735.106-1~deb11u1114.0.5735.106-1~deb12u1114.0.5735.133-1 Show 45 moreShow less 114.0.5735.133-1~deb11u1114.0.5735.133-1~deb12u1114.0.5735.198-1114.0.5735.198-1~deb11u1114.0.5735.198-1~deb12u1114.0.5735.90-1114.0.5735.90-2114.0.5735.90-2~deb11u1114.0.5735.90-2~deb12u1115.0.5790.102-1115.0.5790.102-2115.0.5790.170-1115.0.5790.170-1~deb11u1115.0.5790.170-1~deb12u1115.0.5790.98-1115.0.5790.98-1~deb11u1115.0.5790.98-1~deb12u1115.0.5790.98-2116.0.5845.110-1116.0.5845.110-1~deb11u1116.0.5845.110-1~deb12u1116.0.5845.110-2116.0.5845.140-1116.0.5845.140-1~deb11u1116.0.5845.140-1~deb12u1116.0.5845.180-1116.0.5845.180-1~deb11u1116.0.5845.180-1~deb12u1116.0.5845.96-1116.0.5845.96-1~deb11u1116.0.5845.96-1~deb12u1116.0.5845.96-2117.0.5938.132-1117.0.5938.132-1~deb11u1117.0.5938.132-1~deb12u1117.0.5938.132-2117.0.5938.149-1117.0.5938.149-1~deb11u1117.0.5938.149-1~deb12u1117.0.5938.62-1117.0.5938.62-1~deb11u1117.0.5938.62-1~deb12u1117.0.5938.92-1118.0.5993.117-1118.0.5993.117-1~deb11u1	121.0.6167.139-1~deb12u1
`chromium` Debian:13	before 121.0.6167.139-1	121.0.6167.139-1
`chromium` Debian:14	before 121.0.6167.139-1	121.0.6167.139-1
`opera` openSUSE:Leap 15.5 NonFree	before 107.0.5045.21-lp155.3.36.1	107.0.5045.21-lp155.3.36.1
`chromium` openSUSE:Tumbleweed	before 121.0.6167.184-1.1	121.0.6167.184-1.1
`chromium` openSUSE:Tumbleweed	before 122.0.6261.111-1.1	122.0.6261.111-1.1

History

History
Recorded	Changed	Sources
Nov 3, 2026	affected, aliases, references	OSV
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-1060 is a high vulnerability (CVSS 8.8) in Google Chrome, published January 30, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.89%, the 59th percentile. Fixed in qt5-qtwebengine 5.15.16-r4.

References

Show 42 moreShow less

This page doesn't list everything

Left out here: 37 versions. The JSON record has them.