CVE-2024-5495: 
vulnerability analysis and mitigation

CVE-2024-5495 is a high-severity vulnerability discovered in Google Chrome's Dawn component affecting versions prior to 125.0.6422.141. The vulnerability was reported by wgslfuzz on May 1, 2024, and involves a use-after-free condition that could allow remote attackers to exploit heap corruption through a specially crafted HTML page (Chrome Release).

The vulnerability is classified as a Use After Free (CWE-416) issue in the Dawn component of Google Chrome. It has received a CVSS v3.1 base score of 8.8 (High) from NIST with a vector string of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating network accessibility, low attack complexity, and requiring user interaction. CISA-ADP assessed it with a slightly lower score of 7.5 due to higher attack complexity (NVD).

The vulnerability could potentially lead to heap corruption when exploited through a crafted HTML page, potentially allowing attackers to execute arbitrary code or cause system crashes. The high CVSS scores indicate potential impacts on confidentiality, integrity, and availability of the affected systems (NVD).

The vulnerability requires user interaction and can be exploited remotely through a crafted HTML page. While technical details of the exploit are restricted, the issue has been tracked and documented in the Chromium issue system (Chromium Issue).

Google has released version 125.0.6422.141 of Chrome to address this vulnerability. Users are advised to update their Chrome browsers to this version or later. The fix has also been incorporated into various Linux distributions, including Fedora 39 and 40 (Fedora Update).