CVE-2022-0290

Use after free in Site isolation in Google Chrome prior to 97.0.4692.99 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML…

published February 12, 2022

CVSS
—
EPSS
2%
Percentile
80.9
In the wild
Unconfirmed
What it is

🚨 A crafty HTML page is all an attacker needs to potentially slip past Chrome's defenses! Think of it like a sneaky cat finding a way to escape its yard through an unnoticed hole in the fence — once outside, it's free to roam around! If exploited, this vulnerability could allow an attacker to escape the secure environment of the browser, potentially accessing sensitive information or executing malicious scripts. While there's no known exploitation yet, the implications of such a breach could be serious — privacy and security at stake!

Put simply

Think of it like a sneaky cat finding a way to escape its yard through an unnoticed hole in the fence — once outside, it's free to roam around! This use-after-free vulnerability in Chrome's site isolation feature occurs when memory that has already been freed is still referenced. If an attacker crafts a malicious HTML page, they could leverage this oversight to manipulate memory and execute unauthorized code.

What to do

If exploited, this vulnerability could allow an attacker to escape the secure environment of the browser, potentially accessing sensitive information or executing malicious scripts. While there's no known exploitation yet, the implications of such a breach could be serious — privacy and security at stake! Update Google Chrome to version 97.0.4692.99 or higher immediately to patch this vulnerability. Regularly review and apply security updates to ensure you're protected against similar issues in the future. Remember, keeping your browser up-to-date is a key defense! You've got this! By taking action now, you're a step closer to securing your browsing experience! 🛡️

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02038 · 80.9th percentile
Published
2022-02-12T01:35Z
EPSS history
Timeline
  • 12 FEB 01:35Z
    Use after free in Site isolation in Google Chrome prior to 97.0.4692.99 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML…
    cvelistv5