CVE-2022-0973

Use after free in Safe Browsing in Google Chrome prior to 99.0.4844.74 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page

published July 21, 2022

CVSS
β€”
EPSS
1%
Percentile
60.5
In the wild
Unconfirmed
What it is

⚠️ A crafty HTML page is all it takes! This use-after-free vulnerability in Google Chrome's Safe Browsing could allow attackers to exploit heap corruption without breaking a sweat. πŸ”Ž Think of it like a magician pulling a rabbit out of an empty hat β€” once the rabbit's gone, the hat shouldn't be able to produce anything else! But here, a sneaky page could trick Chrome into using memory that's already been freed, leading to some unexpected surprises. If exploited, this vulnerability could lead to corrupted memory, allowing an attacker to execute arbitrary code and perform actions on the victim's device. It's like giving someone a backdoor into your online world, potentially compromising sensitive information and system integrity β€” absolutely devastating!

Put simply

Think of it like a magician pulling a rabbit out of an empty hat β€” once the rabbit's gone, the hat shouldn't be able to produce anything else! But here, a sneaky page could trick Chrome into using memory that's already been freed, leading to some unexpected surprises. The vulnerability arises from improper handling of memory within the Safe Browsing feature of Google Chrome, allowing attackers to potentially gain control over the user’s session via a specially crafted HTML page.

What to do

If exploited, this vulnerability could lead to corrupted memory, allowing an attacker to execute arbitrary code and perform actions on the victim's device. It's like giving someone a backdoor into your online world, potentially compromising sensitive information and system integrity β€” absolutely devastating! Update Google Chrome to version 99.0.4844.74 or later immediately to mitigate this issue. Regularly check for updates to ensure you're protected from potential exploits. Remember to encourage your users to stay safe by keeping their browsers up to date! You've got this! Stay vigilant and proactive, and you'll keep your browsing experience secure! πŸ›‘οΈ

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00938 Β· 60.5th percentile
Published
2022-07-21T21:05Z
EPSS history
Timeline
  • 21 JUL 21:05Z
    Use after free in Safe Browsing in Google Chrome prior to 99.0.4844.74 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page
    cvelistv5