CVE-2022-2163: Use after free in Cast UI and Toolbar

Reference Links

• https://chromereleases.googleblog.com/2022/07/stable-channel-update-for-desktop_19.html (Advisory)
• https://crbug.com/1308341
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5BQRTR4SIUNIHLLPWTGYSDNQK7DYCRSB/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/H2C4XOJVIILDXTOSMWJXHSQNEXFWSOD7/
• https://security.gentoo.org/glsa/202208-25
• https://security.gentoo.org/glsa/202208-35
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5BQRTR4SIUNIHLLPWTGYSDNQK7DYCRSB/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H2C4XOJVIILDXTOSMWJXHSQNEXFWSOD7/

Parent vulnerabilities

(Appears in the following advisories)

• 8112704297585884798

Peer vulnerabilities

(Found alongside the following vulnerabilities)

• CVE-2022-2477
• CVE-2022-2478
• CVE-2022-2479
• CVE-2022-2480
• CVE-2022-2481
• CVE-2022-4915

Frequently Asked Questions

• What is CVE-2022-2163?

  CVE-2022-2163 is a vulnerability in Google Chrome that allows an attacker to potentially exploit heap corruption via UI interaction.

• How severe is CVE-2022-2163?

  CVE-2022-2163 has a severity rating of 8.8 (high).

• Which software versions are affected by CVE-2022-2163?

  Google Chrome versions prior to 103.0.5060.134, Fedora Extra Packages For Enterprise Linux 8.0, Fedora 35, and Fedora 36 are affected by CVE-2022-2163.

• How can an attacker exploit CVE-2022-2163?

  An attacker can exploit CVE-2022-2163 by convincing a user to install a malicious extension, which can lead to heap corruption via UI interaction.

• Where can I find more information about CVE-2022-2163?

  You can find more information about CVE-2022-2163 in the following references: [1] [2] [3]