Multiple vulnerabilities in Google Chrome



Published: 2022-07-19 | Updated: 2022-07-23
Risk High
Patch available YES
Number of vulnerabilities 6
CVE-ID CVE-2022-2477
CVE-2022-2478
CVE-2022-2480
CVE-2022-2481
CVE-2022-2479
CVE-2022-2163
CWE-ID CWE-416
CWE-20
Exploitation vector Network
Public exploit N/A
Vulnerable software
Subscribe
Google Chrome
Client/Desktop applications / Web browsers

Vendor Google

Security Bulletin

This security bulletin contains information about 6 vulnerabilities.

1) Use-after-free

EUVDB-ID: #VU65446

Risk: High

CVSSv3.1:

CVE-ID: CVE-2022-2477

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error in Guest View when processing HTML content. A remote attacker can trick the victim to visit a specially crafted website, trigger a use-after-free error and execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Google Chrome: 70.0.3538.67 - 103.0.5060.114


CPE2.3 External links

http://chromereleases.googleblog.com/2022/07/stable-channel-update-for-desktop_19.html
http://crbug.com/1336266
http://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-2477

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

2) Use-after-free

EUVDB-ID: #VU65447

Risk: High

CVSSv3.1:

CVE-ID: CVE-2022-2478

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error in PDF component. A remote attacker can trick the victim to visit a specially crafted website, trigger a use-after-free error and execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Google Chrome: 70.0.3538.67 - 103.0.5060.114


CPE2.3 External links

http://chromereleases.googleblog.com/2022/07/stable-channel-update-for-desktop_19.html
http://crbug.com/1335861
http://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-2478

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

3) Use-after-free

EUVDB-ID: #VU65448

Risk: High

CVSSv3.1:

CVE-ID: CVE-2022-2480

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error in Service Worker API when processing HTML content. A remote attacker can trick the victim to visit a specially crafted website, trigger a use-after-free error and execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Google Chrome: 70.0.3538.67 - 103.0.5060.114


CPE2.3 External links

http://chromereleases.googleblog.com/2022/07/stable-channel-update-for-desktop_19.html
http://crbug.com/1339844
http://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-2480

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

4) Use-after-free

EUVDB-ID: #VU65449

Risk: High

CVSSv3.1:

CVE-ID: CVE-2022-2481

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error in Views when processing HTML content. A remote attacker can trick the victim to visit a specially crafted website, trigger a use-after-free error and execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Google Chrome: 70.0.3538.67 - 103.0.5060.114


CPE2.3 External links

http://chromereleases.googleblog.com/2022/07/stable-channel-update-for-desktop_19.html
http://crbug.com/1341603
http://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-2481

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

5) Input validation error

EUVDB-ID: #VU65450

Risk: High

CVSSv3.1:

CVE-ID: CVE-2022-2479

CWE-ID: CWE-20 - Improper Input Validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to insufficient validation of user-supplied input in File component. A remote attacker can trick the victim to visit a specially crafted website and execute arbitrary code on the system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Google Chrome: 70.0.3538.67 - 103.0.5060.114


CPE2.3 External links

http://chromereleases.googleblog.com/2022/07/stable-channel-update-for-desktop_19.html
http://crbug.com/1329987
http://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-2479

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

6) Use-after-free

EUVDB-ID: #VU64566

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2022-2163

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to use-after-free error in Cast UI and Toolbar in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and crash the browser.

Mitigation

Update to version 103.0.5060.53.

Vulnerable software versions

Google Chrome: 70.0.3538.67 - 103.0.5060.114


CPE2.3 External links

http://chromereleases.googleblog.com/2022/07/stable-channel-update-for-desktop_19.html
http://crbug.com/1308341

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?



###SIDEBAR###