CVE-2022-0977

Use after free in Browser UI in Google Chrome on Chrome OS prior to 99.0.4844.74 allowed a remote attacker who convinced a user to engage in specific user…

published July 21, 2022

CVSS
—
EPSS
1%
Percentile
61.3
In the wild
Unconfirmed
What it is

⚠️ A crafty crafted HTML page could lead to heap corruption in Google Chrome on Chrome OS before version 99.0.4844.74, like a sneaky chef serving a dish that's way past its expiration date! This vulnerability is like handing someone a menu with a dish that looks delicious but has all the ingredients expired. If they take a bite, it could lead to some serious issues, just like a browser crash or unexpected behavior after a user interacts wrongly with the page. If exploited, an attacker could potentially manipulate the heap memory, leading to unpredictable behavior in the browser—think of it as your computer going haywire at the worst possible moment. This could compromise user experience, data integrity, or even open the door to other malicious actions. Yikes!

Put simply

This vulnerability is like handing someone a menu with a dish that looks delicious but has all the ingredients expired. If they take a bite, it could lead to some serious issues, just like a browser crash or unexpected behavior after a user interacts wrongly with the page. The vulnerability arises from a use-after-free flaw in the Browser UI of Google Chrome, allowing the heap memory to be corrupted when a user engages in specific interactions with a malicious HTML page.

What to do

If exploited, an attacker could potentially manipulate the heap memory, leading to unpredictable behavior in the browser—think of it as your computer going haywire at the worst possible moment. This could compromise user experience, data integrity, or even open the door to other malicious actions. Yikes! To protect yourself, ensure that your Chrome OS is updated to at least version 99.0.4844.74. Regularly check for updates and consider implementing user education on the dangers of suspicious HTML links. Staying updated is your best defense! You’ve got this! By taking these steps, you’ll keep your browsing experience safe and sound. 🛡️

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00963 · 61.3th percentile
Published
2022-07-21T21:05Z
EPSS history
Timeline
  • 21 JUL 21:05Z
    Use after free in Browser UI in Google Chrome on Chrome OS prior to 99.0.4844.74 allowed a remote attacker who convinced a user to engage in specific user…
    cvelistv5