CVE-2022-2743
Integer overflow in Window Manager in Google Chrome on Chrome OS and Lacros prior to 104.0.5112.79 allowed a remote attacker who convinced a user to engage in specific UI interactions to perform an out of bounds memory write via crafted UI interactions.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.54%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Integer overflow in Window Manager in Google Chrome on Chrome OS and Lacros prior to 104.0.5112.79 allowed a remote attacker who convinced a user to engage in specific UI interactions to perform an out of bounds memory write via crafted UI interactions. (Chrome security severity: High)
- CVSS 3.1
- 8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- EPSS
- 0.54% probability · 44th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-190
- Affected
- google/chrome · google/chrome os · google/linux and chrome os
- Source
- chrome-cve-admin@google.com
References
- https://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop.htmlRelease Notes, Vendor Advisory
- https://crbug.com/1316960Exploit, Issue Tracking, Vendor Advisory
- https://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop.htmlRelease Notes, Vendor Advisory
- https://crbug.com/1316960Exploit, Issue Tracking, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.