PT-2021-6111 · Google+3 · Google Chrome+3

Published 2021-11-24 · Updated 2024-06-15 · CVE-2022-0308

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 97.0.4692.99 Microsoft Edge (affected versions not specified)

Description The issue is related to a use after free vulnerability in the Data Transfer component of Google Chrome and Microsoft Edge browsers. This vulnerability can be exploited by a remote attacker who convinces a user to engage in specific user interaction, potentially allowing the attacker to cause a denial of service or elevate their privileges via a specially crafted HTML page. The exploitation is related to heap corruption.

Recommendations For Google Chrome versions prior to 97.0.4692.99, update to version 97.0.4692.99 or later to resolve the issue. For Microsoft Edge, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

ALT-PU-2022-1148

ALT-PU-2022-1179

ALT-PU-2022-1207

ALT-PU-2022-1261

ALT-PU-2022-1290

BDU:2022-00857

CVE-2022-0308

DSA-5054-1

MGASA-2022-0043

OPENSUSE-SU-2022:0019-1

OPENSUSE-SU-2022:0047-1

OPENSUSE-SU-2022:0110-1

OPENSUSE-SU-2022_0047-1

OPENSUSE-SU-2022_0110-1

OPENSUSE-SU-2024:11761-1

OPENSUSE-SU-2024:12948-1

Affected Products

Alt Linux

Google Chrome

Edge

Suse

References · 2343

• https://osv.dev/vulnerability/openSUSE-SU-2022:0047-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-0308 · Vendor Advisory
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-0308 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2022:0019-1 · Vendor Advisory
• https://chromereleases.googleblog.com/2022/01/stable-channel-update-for-desktop_19.html · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-0308 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:12948-1 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2022-0043 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2022:0110-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-0308 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:11761-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-0308 · Security Note
• https://crbug.com/1282480 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-0308 · Security Note
• https://osv.dev/vulnerability/CVE-2022-0308 · Vendor Advisory