CVE-2022-0300: Use after free in Text Input Method Editor

Q: What is CVE-2022-0300?

CVE-2022-0300 is a vulnerability in Google Chrome on Android that allows a remote attacker to potentially exploit heap corruption through specific user interactions.

Q: How severe is CVE-2022-0300?

CVE-2022-0300 has a severity rating of 8.8, classified as high.

Q: Which software versions are affected by CVE-2022-0300?

Google Chrome on Android versions prior to 97.0.4692.99 are affected by CVE-2022-0300.

Q: How can CVE-2022-0300 be exploited?

CVE-2022-0300 can be exploited by a remote attacker who convinces a user to engage in specific user interactions using a crafted HTML page.

Q: Are all versions of Google Android affected by CVE-2022-0300?

No, Google Android itself is not vulnerable to CVE-2022-0300.

Published Dec 1, 2021

Updated

Use after free in Text Input Method Editor in Google Chrome on Android prior to 97.0.4692.99 allowed a remote attacker who convinced a user to engage in specific user interactions to potentially exploit heap corruption via a crafted HTML page.

Credit

Rong Jian(360 Alpha Lab), Guang Gong(360 Alpha Lab)

Affected Software

3 affected componentsFixes available

Google Chrome<97.0.4692.99

97.0.4692.99

Google Chrome<97.0.4692.99

Google Android

Event History

Dec 1, 2021

CVE Published

12:00 AM

Feb 12, 2022

CVE Published

via MITRE·01:35 AM

Data Sourced

via MITRE·01:35 AM

DescriptionWeakness

Parent advisories

This vulnerability appears in the following advisories.

2951730441638118565

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

What is CVE-2022-0300?

CVE-2022-0300 is a vulnerability in Google Chrome on Android that allows a remote attacker to potentially exploit heap corruption through specific user interactions.

How severe is CVE-2022-0300?

CVE-2022-0300 has a severity rating of 8.8, classified as high.

Which software versions are affected by CVE-2022-0300?