Actively exploited · Published Nov 25, 2022 · Assigned by Chrome

CVE-2022-4135

Critical 9.6 Exploited

In plain English

A critical-severity out-of-bounds write in Chrome from Google. Attackers are actively exploiting it in the wild (listed by CISA on November 28, 2022). The chance it is exploited in the next 30 days is estimated at 31.9% (higher than 98% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.6Critical

Exploit odds (30 days)31.9%top 1.7% of all CVEs

Exploited in the wildYesCISA KEV since Nov 28, 2022

Attack toolingNoneno public tooling known

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by Dec 19, 2022.

Official description

Heap buffer overflow in GPU in Google Chrome prior to 107.0.5304.121 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	chromium	107.0.5304.121-1	DEBIAN-CVE-2022-4135
Debian:13	chromium	107.0.5304.121-1	DEBIAN-CVE-2022-4135
Debian:14	chromium	107.0.5304.121-1	DEBIAN-CVE-2022-4135
npm	electron	19.1.8	GHSA-995f-9x5r-2rcj

Affected products (as reported)

Vendor	Product	Versions
Google	Chrome	unspecified – before 107.0.5304.121

Weakness: CWE-787 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

References

https://chromereleases.googleblog.com/2022/11/stable-channel-update-for-desktop_24.html
https://crbug.com/1392715
GLSA-202305-10 vendor-advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-4135 government-resource