Multiple vulnerabilities in Google Chrome

1) Use-after-free

EUVDB-ID: #VU66847

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2022-3049

CWE-ID:

Exploit availability:

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within SplitScreen in Google Chrome. A remote attacker can trick the victim into visiting a specially crafted web page, trigger a use-after-free error and gain access to sensitive information.

Mitigation

Update to version 105.0.5195.52.

Vulnerable software versions

Google Chrome: 70.0.3538.67 - 104.0.5112.102

Fixed software versions

CPE2.3

• cpe:2.3:a:google:google_chrome:104.0.5112.101:*:*:*:*:*:*:*

External links

http://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop_30.html
http://crbug.com/1316892

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

2) Use-after-free

EUVDB-ID: #VU66856

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2022-3058

CWE-ID:

Exploit availability:

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to use-after-free error in Sign-In Flow in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and crash the browser.

Mitigation

Update to version 105.0.5195.52.

Vulnerable software versions

Google Chrome: 70.0.3538.67 - 104.0.5112.102

Fixed software versions

CPE2.3

• cpe:2.3:a:google:google_chrome:104.0.5112.101:*:*:*:*:*:*:*

External links

http://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop_30.html
http://crbug.com/1337676
http://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-3058

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

3) Improperly implemented security check for standard

EUVDB-ID: #VU66855

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2022-3057

CWE-ID:

Exploit availability:

Description

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to incorrect implementation in iframe Sandbox in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

Mitigation

Update to version 105.0.5195.52.

Vulnerable software versions

Google Chrome: 70.0.3538.67 - 104.0.5112.102

Fixed software versions

CPE2.3

• cpe:2.3:a:google:google_chrome:104.0.5112.101:*:*:*:*:*:*:*

External links

http://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop_30.html
http://crbug.com/1336904
http://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-3057

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

4) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU66854

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2022-3056

CWE-ID:

Exploit availability:

Description

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to insufficient policy enforcement in Content Security Policy in Google Chrome. A remote attacker can trick the victim to visit a specially crafted website, bypass implemented security measures and gain access to sensitive information.

Mitigation

Update to version 105.0.5195.52.

Vulnerable software versions

Google Chrome: 70.0.3538.67 - 104.0.5112.102

Fixed software versions

CPE2.3

• cpe:2.3:a:google:google_chrome:104.0.5112.101:*:*:*:*:*:*:*

External links

http://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop_30.html
http://crbug.com/1329460
http://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-3056

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

5) Use-after-free

EUVDB-ID: #VU66853

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2022-3055

CWE-ID:

Exploit availability:

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within Passwords in Google Chrome. A remote attacker can trick the victim into visiting a specially crafted web page, trigger a use-after-free error and gain access to sensitive information.

Mitigation

Update to version 105.0.5195.52.

Vulnerable software versions

Google Chrome: 70.0.3538.67 - 104.0.5112.102

Fixed software versions

CPE2.3

• cpe:2.3:a:google:google_chrome:104.0.5112.101:*:*:*:*:*:*:*

External links

http://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop_30.html
http://crbug.com/1351969
http://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-3055

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

6) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU66852

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2022-3054

CWE-ID:

Exploit availability:

Description

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to insufficient policy enforcement in DevTools in Google Chrome. A remote attacker can trick the victim to visit a specially crafted website, bypass implemented security measures and gain access to sensitive information.

Mitigation

Update to version 105.0.5195.52.

Vulnerable software versions

Google Chrome: 70.0.3538.67 - 104.0.5112.102

Fixed software versions

CPE2.3

• cpe:2.3:a:google:google_chrome:104.0.5112.101:*:*:*:*:*:*:*

External links

http://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop_30.html
http://crbug.com/1290236
http://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-3054

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

7) Improperly implemented security check for standard

EUVDB-ID: #VU66851

Risk: High

CVSSv3.1:

CVE-ID: CVE-2022-3053

CWE-ID:

Exploit availability:

Description

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to incorrect implementation in Pointer Lock in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

Mitigation

Update to version 105.0.5195.52.

Vulnerable software versions

Google Chrome: 70.0.3538.67 - 104.0.5112.102

Fixed software versions

CPE2.3

• cpe:2.3:a:google:google_chrome:104.0.5112.101:*:*:*:*:*:*:*

External links

http://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop_30.html
http://crbug.com/1267867
http://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-3053

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

8) Heap-based buffer overflow

EUVDB-ID: #VU66850

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2022-3052

CWE-ID:

Exploit availability:

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing untrusted HTML content in Window Manager. A remote attacker can create a specially crafted web page, trick the victim into opening it, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Mitigation

Update to version 105.0.5195.52.

Vulnerable software versions

Google Chrome: 70.0.3538.67 - 104.0.5112.102

Fixed software versions

CPE2.3

• cpe:2.3:a:google:google_chrome:104.0.5112.101:*:*:*:*:*:*:*

External links

http://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop_30.html
http://crbug.com/1346154

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

9) Heap-based buffer overflow

EUVDB-ID: #VU66849

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2022-3051

CWE-ID:

Exploit availability:

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing untrusted HTML content in Exosphere. A remote attacker can create a specially crafted web page, trick the victim into opening it, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Mitigation

Update to version 105.0.5195.52.

Vulnerable software versions

Google Chrome: 70.0.3538.67 - 104.0.5112.102

Fixed software versions

CPE2.3

• cpe:2.3:a:google:google_chrome:104.0.5112.101:*:*:*:*:*:*:*

External links

http://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop_30.html
http://crbug.com/1345245

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

10) Heap-based buffer overflow

EUVDB-ID: #VU66848

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2022-3050

CWE-ID:

Exploit availability:

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing untrusted HTML content in WebUI. A remote attacker can create a specially crafted web page, trick the victim into opening it, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Mitigation

Update to version 105.0.5195.52.

Vulnerable software versions

Google Chrome: 70.0.3538.67 - 104.0.5112.102

Fixed software versions

CPE2.3

• cpe:2.3:a:google:google_chrome:104.0.5112.101:*:*:*:*:*:*:*

External links

http://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop_30.html
http://crbug.com/1337132

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

11) Improperly implemented security check for standard

EUVDB-ID: #VU66846

Risk: High

CVSSv3.1:

CVE-ID: CVE-2022-3048

CWE-ID:

Exploit availability:

Description

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to incorrect implementation in Chrome OS lockscreen in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

Mitigation

Update to version 105.0.5195.52.

Vulnerable software versions

Google Chrome: 70.0.3538.67 - 104.0.5112.102

Fixed software versions

CPE2.3

• cpe:2.3:a:google:google_chrome:104.0.5112.101:*:*:*:*:*:*:*

External links

http://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop_30.html
http://crbug.com/1303308

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

12) Use-after-free

EUVDB-ID: #VU66836

Risk: Critical

CVSSv3.1:

CVE-ID: CVE-2022-3038

CWE-ID:

Exploit availability:

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the Network Service component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Note, the vulnerability is known to be exploited in the wild.

Mitigation

Update to version 105.0.5195.52.

Vulnerable software versions

Google Chrome: 70.0.3538.67 - 104.0.5112.102

Fixed software versions

CPE2.3

• cpe:2.3:a:google:google_chrome:104.0.5112.101:*:*:*:*:*:*:*

External links

http://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop_30.html
http://crbug.com/1340253
http://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-3038
http://blog.google/threat-analysis-group/spyware-vendors-use-0-days-and-n-days-against-popular-platforms/

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

13) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU66845

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2022-3047

CWE-ID:

Exploit availability:

Description

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to insufficient policy enforcement in Extensions API in Google Chrome. A remote attacker can trick the victim to visit a specially crafted website, bypass implemented security measures and gain access to sensitive information.

Mitigation

Update to version 105.0.5195.52.

Vulnerable software versions

Google Chrome: 70.0.3538.67 - 104.0.5112.102

Fixed software versions

CPE2.3

• cpe:2.3:a:google:google_chrome:104.0.5112.101:*:*:*:*:*:*:*

External links

http://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop_30.html
http://crbug.com/1342586
http://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-3047

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

14) Use-after-free

EUVDB-ID: #VU66844

Risk: High

CVSSv3.1:

CVE-ID: CVE-2022-3046

CWE-ID:

Exploit availability:

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the Browser Tag component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Update to version 105.0.5195.52.

Vulnerable software versions

Google Chrome: 70.0.3538.67 - 104.0.5112.102

Fixed software versions

CPE2.3

• cpe:2.3:a:google:google_chrome:104.0.5112.101:*:*:*:*:*:*:*

External links

http://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop_30.html
http://crbug.com/1346245
http://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-3046

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

15) Input validation error

EUVDB-ID: #VU66843

Risk: High

CVSSv3.1:

CVE-ID: CVE-2022-3045

CWE-ID:

Exploit availability:

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation in V8 component in Google Chrome. A remote attacker can trick the victim to open a specially crafted web page and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update to version 105.0.5195.52.

Vulnerable software versions

Google Chrome: 70.0.3538.67 - 104.0.5112.102

Fixed software versions

CPE2.3

• cpe:2.3:a:google:google_chrome:104.0.5112.101:*:*:*:*:*:*:*

External links

http://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop_30.html
http://crbug.com/1339648
http://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-3045

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

16) Improperly implemented security check for standard

EUVDB-ID: #VU66842

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2022-3044

CWE-ID:

Exploit availability:

Description

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to incorrect implementation in Site Isolation in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and compromise the system.

Mitigation

Update to version 105.0.5195.52.

Vulnerable software versions

Google Chrome: 70.0.3538.67 - 104.0.5112.102

Fixed software versions

CPE2.3

• cpe:2.3:a:google:google_chrome:104.0.5112.101:*:*:*:*:*:*:*

External links

http://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop_30.html
http://crbug.com/1051198
http://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-3044

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

17) Heap-based buffer overflow

EUVDB-ID: #VU66841

Risk: High

CVSSv3.1:

CVE-ID: CVE-2022-3043

CWE-ID:

Exploit availability:

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing untrusted HTML content in Screen Capture. A remote attacker can create a specially crafted web page, trick the victim into opening it, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Mitigation

Update to version 105.0.5195.52.

Vulnerable software versions

Google Chrome: 70.0.3538.67 - 104.0.5112.102

Fixed software versions

CPE2.3

• cpe:2.3:a:google:google_chrome:104.0.5112.101:*:*:*:*:*:*:*

External links

http://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop_30.html
http://crbug.com/1336979

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

18) Use-after-free

EUVDB-ID: #VU66840

Risk: High

CVSSv3.1:

CVE-ID: CVE-2022-3042

CWE-ID:

Exploit availability:

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the PhoneHub component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Update to version 105.0.5195.52.

Vulnerable software versions

Google Chrome: 70.0.3538.67 - 104.0.5112.102

Fixed software versions

CPE2.3

• cpe:2.3:a:google:google_chrome:104.0.5112.101:*:*:*:*:*:*:*

External links

http://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop_30.html
http://crbug.com/1338553

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

19) Use-after-free

EUVDB-ID: #VU66839

Risk: High

CVSSv3.1:

CVE-ID: CVE-2022-3041

CWE-ID:

Exploit availability:

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the WebSQL component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Update to version 105.0.5195.52.

Vulnerable software versions

Google Chrome: 70.0.3538.67 - 104.0.5112.102

Fixed software versions

CPE2.3

• cpe:2.3:a:google:google_chrome:104.0.5112.101:*:*:*:*:*:*:*

External links

http://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop_30.html
http://crbug.com/1345947
http://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-3041

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

20) Use-after-free

EUVDB-ID: #VU66838

Risk: High

CVSSv3.1:

CVE-ID: CVE-2022-3040

CWE-ID:

Exploit availability:

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the Layout component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Update to version 105.0.5195.52.

Vulnerable software versions

Google Chrome: 70.0.3538.67 - 104.0.5112.102

Fixed software versions

CPE2.3

• cpe:2.3:a:google:google_chrome:104.0.5112.101:*:*:*:*:*:*:*

External links

http://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop_30.html
http://crbug.com/1341539
http://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-3040

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

21) Use-after-free

EUVDB-ID: #VU66837

Risk: High

CVSSv3.1:

CVE-ID: CVE-2022-3039

CWE-ID:

Exploit availability:

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the WebSQL component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Update to version 105.0.5195.52.

Vulnerable software versions

Google Chrome: 70.0.3538.67 - 104.0.5112.102

Fixed software versions

CPE2.3

• cpe:2.3:a:google:google_chrome:104.0.5112.101:*:*:*:*:*:*:*

External links

http://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop_30.html
http://crbug.com/1343348
http://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-3039

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

22) Use-after-free

EUVDB-ID: #VU66939

Risk: High

CVSSv3.1:

CVE-ID: CVE-2022-3071

CWE-ID:

Exploit availability:

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the Tab Strip component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Update to version 105.0.5195.52.

Vulnerable software versions

Google Chrome: 70.0.3538.67 - 104.0.5112.102

Fixed software versions

CPE2.3

• cpe:2.3:a:google:google_chrome:104.0.5112.101:*:*:*:*:*:*:*

External links

http://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop_30.html
http://crbug.com/1333995

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

23) Improperly implemented security check for standard

EUVDB-ID: #VU79624

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2022-4913

CWE-ID:

Exploit availability:

Description

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to incorrect implementation in Extensions in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and compromise the system.

Mitigation

Update to version 105.0.5195.52.

Vulnerable software versions

Google Chrome: before 105.0.5195.52

Fixed software versions

CPE2.3

• cpe:2.3:a:google:google_chrome:*:*:*:*:*:*:*:

External links

http://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop_30.html
http://crbug.com/1183604

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

24) Type Confusion

EUVDB-ID: #VU79623

Risk: High

CVSSv3.1:

CVE-ID: CVE-2022-4912

CWE-ID:

Exploit availability:

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a type confusion error within the MathML component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger a type confusion error and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update to version 105.0.5195.52.

Vulnerable software versions

Google Chrome: before 105.0.5195.52

Fixed software versions

CPE2.3

• cpe:2.3:a:google:google_chrome:*:*:*:*:*:*:*:

External links

http://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop_30.html
http://crbug.com/1350909

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?