PT-2022-22176 · Google+3 · Google Chrome+3

Published 2022-10-11 · Updated 2024-10-24 · CVE-2022-3448

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 106.0.5249.119

Description The issue allows a remote attacker to potentially exploit heap corruption via a crafted HTML page if a user is convinced to engage in specific UI gestures. This is related to a use after free in the Permissions API.

Recommendations For versions prior to 106.0.5249.119, update to version 106.0.5249.119 or later to resolve the issue. As a temporary workaround, consider restricting access to crafted HTML pages until the update is applied.

Exploit

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

ALT-PU-2022-2840

ALT-PU-2022-2905

ALT-PU-2022-2959

ALT-PU-2023-1462

CVE-2022-3448

DSA-5253-1

MGASA-2022-0376

OPENSUSE-SU-2022:10146-1

OPENSUSE-SU-2022:10151-1

OPENSUSE-SU-2022:10181-1

OPENSUSE-SU-2022:10182-1

OPENSUSE-SU-2022_10181-1

OPENSUSE-SU-2022_10182-1

OPENSUSE-SU-2023:0115-1

OPENSUSE-SU-2023_0115-1

OPENSUSE-SU-2024:12404-1

OPENSUSE-SU-2024:12948-1

Affected Products

Alt Linux

Astra Linux

Google Chrome

Suse

References · 2354

• 🔥 https://github.com/bjrjk/CVE-2022-4262 · Exploit
• 🔥 https://github.com/mistymntncop/CVE-2023-2033 · Exploit
• 🔥 https://github.com/mistymntncop/CVE-2022-4262 · Exploit
• 🔥 https://github.com/momika233/CVE-2022-3656 · Exploit
• 🔥 https://github.com/sandumjacob/CVE-2023-2033-Analysis · Exploit
• 🔥 https://github.com/insoxin/CVE-2023-2033 · Exploit
• 🔥❌ https://github.com/xem6/CVE-2022-4262 · Exploit, Deleted
• https://osv.dev/vulnerability/DSA-5253-1 · Vendor Advisory
• https://security.gentoo.org/glsa/202305-10 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-3448 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:12404-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-3448 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-3448 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:12948-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2022-0376.html · Security Note