Every CVE Search/ Get API key

CVE-2024-2885

Use after free in Dawn in Google Chrome prior to 123.0.6312.86 allowed a remote attacker to...

8.8 HighFix available

Use after free in Dawn in Google Chrome prior to 123.0.6312.86 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

1.49%Up 1.4 points since Mar 27, 2024
90%50%10%1%

What each source reports

NVD Score used 8.8

Use after free in Dawn in Google Chrome prior to 123.0.6312.86 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Record
CVE-2024-2885
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-416
Updated
2026-11-02
CVE List 8.8

Use after free in Dawn in Google Chrome prior to 123.0.6312.86 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Record
CVE-2024-2885
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-416
Updated
2026-11-02
EUVDEUVD-2024-27829 8.8

Use after free in Dawn in Google Chrome prior to 123.0.6312.86 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Record
EUVD-2024-27829
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-qccw-wmvp-8pv9 7.5

Use after free in Dawn in Google Chrome prior to 123.0.6312.86 allowed a remote attacker to...

Use after free in Dawn in Google Chrome prior to 123.0.6312.86 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Record
GHSA-qccw-wmvp-8pv9
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-416
Updated
2026-11-02
OSV 8.8

Use after free in Dawn in Google Chrome prior to 123.0.6312.86 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Record
CVE-2024-2885
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2024-2885 8.8

Use after free in Dawn in Google Chrome prior to 123.0.6312.86 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Record
DEBIAN-CVE-2024-2885
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVopenSUSE-SU-2024:0122-1 No score

Security update for opera

Opera was updated to fix the following issues:

Update to 109.0.5097.45

  • CHR-9416 Updating Chromium on desktop-stable-* branches
  • DNA-114737 [Search box] It's getting blurred when click on it, also lower corners are not rounded sometimes
  • DNA-115042 '+' button is not responsive when 30+ tabs opened
  • DNA-115326 Wrong fonts and padding after intake
  • DNA-115392 [Badges] Text displayed in red
  • DNA-115501 'Review your payment' native popup has wrong colors
  • DNA-115809 Enable #show-duplicate-indicator-on-link on all streams

Update to 109.0.5097.38

  • CHR-9695 Update Chromium on desktop-stable-123-5097 to 123.0.6312.87
  • DNA-115156 [Login and Password suggestion] Suggestions are bolded and highlight doesn`t fill all area
  • DNA-115313 No video playback on skyshowtime.com
  • DNA-115639 [Version 109][Detached window] Missing functions names in light mode
  • DNA-115812 Enable #startpage-opening-animation on all streams
  • DNA-115836 Lucid mode visual issues on H264 videos
  • The update to chromium 109.0.5097.38 fixes following issues: CVE-2024-2883, CVE-2024-2885, CVE-2024-2886, CVE-2024-2887

Update to 109.0.5097.33

  • CHR-9674 Update Chromium on desktop-stable-123-5097 to 123.0.6312.46
  • DNA-115357 [Settings] Search toolbar has wrong position
  • DNA-115396 Bolded camera icon when camera access is allowed
  • DNA-115478 AI Prompts in text highlight popup not displayed properly
  • DNA-115563 Wallet selector not working
  • DNA-115601 Remove 'moving text' animation in the tab cycler
  • DNA-115645 Internal pages icons unreadable when highlight
  • DNA-115717 'Your extension was disabled because it is corrupted' message is displayed to user
  • DNA-115770 Promote 109 to stable
Record
openSUSE-SU-2024:0122-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:13953-1 No score

chromedriver-124.0.6367.201-1.1 on GA media

These are all security issues fixed in the chromedriver-124.0.6367.201-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:13953-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
chromium
Debian:12
before 123.0.6312.86-1~deb12u1, plus listed versions
113.0.5672.126-1114.0.5735.106-1114.0.5735.106-1~deb11u1114.0.5735.106-1~deb12u1114.0.5735.133-1
Show 45 moreShow less
114.0.5735.133-1~deb11u1114.0.5735.133-1~deb12u1114.0.5735.198-1114.0.5735.198-1~deb11u1114.0.5735.198-1~deb12u1114.0.5735.90-1114.0.5735.90-2114.0.5735.90-2~deb11u1114.0.5735.90-2~deb12u1115.0.5790.102-1115.0.5790.102-2115.0.5790.170-1115.0.5790.170-1~deb11u1115.0.5790.170-1~deb12u1115.0.5790.98-1115.0.5790.98-1~deb11u1115.0.5790.98-1~deb12u1115.0.5790.98-2116.0.5845.110-1116.0.5845.110-1~deb11u1116.0.5845.110-1~deb12u1116.0.5845.110-2116.0.5845.140-1116.0.5845.140-1~deb11u1116.0.5845.140-1~deb12u1116.0.5845.180-1116.0.5845.180-1~deb11u1116.0.5845.180-1~deb12u1116.0.5845.96-1116.0.5845.96-1~deb11u1116.0.5845.96-1~deb12u1116.0.5845.96-2117.0.5938.132-1117.0.5938.132-1~deb11u1117.0.5938.132-1~deb12u1117.0.5938.132-2117.0.5938.149-1117.0.5938.149-1~deb11u1117.0.5938.149-1~deb12u1117.0.5938.62-1117.0.5938.62-1~deb11u1117.0.5938.62-1~deb12u1117.0.5938.92-1118.0.5993.117-1118.0.5993.117-1~deb11u1
123.0.6312.86-1~deb12u1
chromium
Debian:13
before 123.0.6312.86-1
123.0.6312.86-1
chromium
Debian:14
before 123.0.6312.86-1
123.0.6312.86-1
chromium
Debian:12
From an advisory covering 12 CVEs
before 123.0.6312.86-1~deb12u1, plus listed versions
113.0.5672.126-1114.0.5735.106-1114.0.5735.106-1~deb11u1114.0.5735.106-1~deb12u1114.0.5735.133-1
Show 45 moreShow less
114.0.5735.133-1~deb11u1114.0.5735.133-1~deb12u1114.0.5735.198-1114.0.5735.198-1~deb11u1114.0.5735.198-1~deb12u1114.0.5735.90-1114.0.5735.90-2114.0.5735.90-2~deb11u1114.0.5735.90-2~deb12u1115.0.5790.102-1115.0.5790.102-2115.0.5790.170-1115.0.5790.170-1~deb11u1115.0.5790.170-1~deb12u1115.0.5790.98-1115.0.5790.98-1~deb11u1115.0.5790.98-1~deb12u1115.0.5790.98-2116.0.5845.110-1116.0.5845.110-1~deb11u1116.0.5845.110-1~deb12u1116.0.5845.110-2116.0.5845.140-1116.0.5845.140-1~deb11u1116.0.5845.140-1~deb12u1116.0.5845.180-1116.0.5845.180-1~deb11u1116.0.5845.180-1~deb12u1116.0.5845.96-1116.0.5845.96-1~deb11u1116.0.5845.96-1~deb12u1116.0.5845.96-2117.0.5938.132-1117.0.5938.132-1~deb11u1117.0.5938.132-1~deb12u1117.0.5938.132-2117.0.5938.149-1117.0.5938.149-1~deb11u1117.0.5938.149-1~deb12u1117.0.5938.62-1117.0.5938.62-1~deb11u1117.0.5938.62-1~deb12u1117.0.5938.92-1118.0.5993.117-1118.0.5993.117-1~deb11u1
123.0.6312.86-1~deb12u1
opera
openSUSE:Leap 15.6 NonFree
From an advisory covering 4 CVEs
before 109.0.5097.45-lp156.2.3.1
109.0.5097.45-lp156.2.3.1
chromium
openSUSE:Tumbleweed
From an advisory covering 35 CVEs
before 124.0.6367.201-1.1
124.0.6367.201-1.1

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-2885 is a high vulnerability (CVSS 8.8) in Google Chrome, published March 26, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.49%, the 74th percentile. Fixed in chromium 123.0.6312.86-1~deb12u1.

References

Show 38 moreShow less
This page doesn't list everything

Left out here: 100 versions. The JSON record has them.

MoveEnter Open