CVE-2022-2742
Use after free in Exosphere in Google Chrome on Chrome OS and Lacros prior to 104.0.5112.79 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via crafted UI interactions.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.40%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Use after free in Exosphere in Google Chrome on Chrome OS and Lacros prior to 104.0.5112.79 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via crafted UI interactions. (Chrome security severity: High)
- CVSS 3.1
- 8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- EPSS
- 0.40% probability · 33th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-362, CWE-416
- Affected
- google/chrome
- Source
- chrome-cve-admin@google.com
References
- https://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop.htmlRelease Notes, Vendor Advisory
- https://crbug.com/1319172Exploit, Issue Tracking, Vendor Advisory
- https://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop.htmlRelease Notes, Vendor Advisory
- https://crbug.com/1319172Exploit, Issue Tracking, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.