PT-2023-12901 · Google+1 · Google Chrome+1

Published 2022-08-07 · Updated 2024-10-22 · CVE-2022-2742

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Google Chrome on Chrome OS and Lacros versions prior to 104.0.5112.79

Description A use after free issue in Exosphere allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via crafted UI interactions.

Recommendations For versions prior to 104.0.5112.79, update to version 104.0.5112.79 or later to resolve the issue. As a temporary workaround, consider restricting user interactions with the Exosphere component until a patch is available.

Exploit

Fix

Race Condition

Use After Free

Weakness Enumeration

CWE-362

CWE-416

Related Identifiers

CVE-2022-2742

DSA-5201-1

Affected Products

Astra Linux

Google Chrome

References · 13

• 🔥 https://crbug.com/1319172 · Exploit
• https://security-tracker.debian.org/tracker/CVE-2022-2742 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-2742 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-2742 · Security Note
• https://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-2742 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5201-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-2742 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-2742 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-2742 · Vendor Advisory
• https://t.me/cvenotify/41145 · Telegram Post
• https://t.me/cvenotify/99117 · Telegram Post
• https://t.me/cibsecurity/55795 · Telegram Post