CVE-2022-2010

Out of bounds read in compositing in Google Chrome prior to 102.0.5005.115 allowed a remote attacker who had compromised the renderer process to potentially…

published July 28, 2022

CVSS
—
EPSS
1%
Percentile
69.3
In the wild
Unconfirmed
What it is

⚠️ A crafty HTML page is all it takes for a remote attacker to potentially escape the Chrome sandbox! Think of it like a magician who learns how to slip out of their own box — they appear safe inside, but with the right trick, they can break free and cause chaos outside! If exploited, this out-of-bounds read flaw could allow attackers to bypass the protections of the Chrome browser, opening the door to unauthorized actions like stealing sensitive information or installing malicious software. It’s not just a theoretical concern; the consequences could be absolutely devastating!

Put simply

Think of it like a magician who learns how to slip out of their own box — they appear safe inside, but with the right trick, they can break free and cause chaos outside! This vulnerability allows a remote attacker to perform an out-of-bounds read in the compositing process, which could lead to a potential sandbox escape if the renderer process is compromised. Essentially, the attacker could read memory locations they shouldn't have access to.

What to do

If exploited, this out-of-bounds read flaw could allow attackers to bypass the protections of the Chrome browser, opening the door to unauthorized actions like stealing sensitive information or installing malicious software. It’s not just a theoretical concern; the consequences could be absolutely devastating! To protect yourself, ensure that you update Google Chrome to version 102.0.5005.115 or later. Additionally, encourage users to regularly check for updates to maintain a secure browsing environment. You've got this! Stay vigilant and keep your browser up to date for a safer online experience! 🛡️

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01257 · 69.3th percentile
Published
2022-07-28T00:10Z
EPSS history
Timeline
  • 28 JUL 00:10Z
    Out of bounds read in compositing in Google Chrome prior to 102.0.5005.115 allowed a remote attacker who had compromised the renderer process to potentially…
    cvelistv5