CVE-2022-1311: Use after free in Chrome OS shell

Q: What is CVE-2022-1311?

CVE-2022-1311 is a vulnerability in Google Chrome on ChromeOS that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Q: What is the severity of CVE-2022-1311?

CVE-2022-1311 has a severity rating of 8.8, which is classified as high.

Q: How does CVE-2022-1311 affect Google Chrome and ChromeOS?

CVE-2022-1311 affects Google Chrome on ChromeOS prior to version 100.0.4896.88.

Q: How can a remote attacker exploit CVE-2022-1311?

A remote attacker can potentially exploit CVE-2022-1311 by using a crafted HTML page to trigger a use-after-free vulnerability in the shell of Google Chrome.

Q: Is Google Chrome OS vulnerable to CVE-2022-1311?

No, Google Chrome OS is not vulnerable to CVE-2022-1311.

Published Mar 28, 2022

Updated

Use after free in shell in Google Chrome on ChromeOS prior to 100.0.4896.88 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Credit

Nan Wang@@eternalsakura13(360 Alpha Lab), Guang Gong(360 Alpha Lab)

Affected Software

7 affected componentsFixes available

Google Chrome<100.0.4896.88

100.0.4896.88

Google Chrome<100.0.4896.88

Google Chrome OS

debian/chromium<100.0.4896.88-1

100.0.4896.88-1

debian/chromium<100.0.4896.88-1

100.0.4896.88-1

debian/chromium<100.0.4896.88-1

100.0.4896.88-1

debian/chromium

150.0.7871.100-1~deb12u1156.0.8078.79-1~deb12u1150.0.7871.181-1~deb13u1156.0.8078.79-1~deb13u1156.0.8078.79-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Google Chrome (Trace Event) to a version that resolves this vulnerability.
Fixed in 100.0.4896.88
Upgrade
Upgrade debian/chromium to a version that resolves this vulnerability.
Fixed in 100.0.4896.88-1
Upgrade
Upgrade debian/chromium to a version that resolves this vulnerability.
Fixed in 150.0.7871.100-1~deb12u1Fixed in 156.0.8078.79-1~deb12u1Fixed in 150.0.7871.181-1~deb13u1Fixed in 156.0.8078.79-1~deb13u1Fixed in 156.0.8078.79-1

Event History

Mar 28, 2022

CVE Published

12:00 AM

Jul 25, 2022

CVE Published

via MITRE·01:40 PM

Data Sourced

via MITRE·01:40 PM

DescriptionWeakness

Data Sourced

via OSV·02:15 PM

DescriptionSeverityAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

What is CVE-2022-1311?

CVE-2022-1311 is a vulnerability in Google Chrome on ChromeOS that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page.

What is the severity of CVE-2022-1311?

CVE-2022-1311 has a severity rating of 8.8, which is classified as high.

How does CVE-2022-1311 affect Google Chrome and ChromeOS?

CVE-2022-1311 affects Google Chrome on ChromeOS prior to version 100.0.4896.88.

How can a remote attacker exploit CVE-2022-1311?

A remote attacker can potentially exploit CVE-2022-1311 by using a crafted HTML page to trigger a use-after-free vulnerability in the shell of Google Chrome.

Is Google Chrome OS vulnerable to CVE-2022-1311?

No, Google Chrome OS is not vulnerable to CVE-2022-1311.

CVE-2022-1311: Use after free in Chrome OS shell

Credit

Affected Software

Remediation

Event History

Parent advisories

Peer vulnerabilities

Frequently Asked Questions

What is CVE-2022-1311?

What is the severity of CVE-2022-1311?

How does CVE-2022-1311 affect Google Chrome and ChromeOS?

How can a remote attacker exploit CVE-2022-1311?

Is Google Chrome OS vulnerable to CVE-2022-1311?

Company

Resources

Contact