critical9.6Known exploited
CVE-2022-4135
Heap buffer overflow in GPU
Exploited in the wild
This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2022-11-28. Federal due date: 2022-12-19.
Apply updates per vendor instructions.
Impact
Heap buffer overflow in GPU in Google Chrome prior to 107.0.5304.121 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | electron | >= 19.0.0, < 19.1.8 | 19.1.8 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Chrome | before 107.0.5304.121 | |
| Microsoft | Edge | before 107.0.1418.62 |
| Microsoft | Edge Chromium | before 107.0.5304.150 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- CISA KEV catalog
- https://chromereleases.googleblog.com/2022/11/stable-channel-update-for-desktop_24.html
- https://crbug.com/1392715
- https://security.gentoo.org/glsa/202305-10
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-4135
- https://github.com/advisories/GHSA-995f-9x5r-2rcj
- https://nvd.nist.gov/vuln/detail/CVE-2022-4135
- https://github.com/electron/electron/pull/36444
- https://github.com/electron/electron/pull/36447