CVE-2022-2859: Use after free in Chrome OS Shell

Q: What is the severity of CVE-2022-2859?

CVE-2022-2859 has a high severity rating as it allows potential remote exploitation through UI interactions.

Q: How do I fix CVE-2022-2859?

To fix CVE-2022-2859, ensure you update Google Chrome to version 104.0.5112.101 or later.

Q: What types of systems are affected by CVE-2022-2859?

CVE-2022-2859 affects Google Chrome versions prior to 104.0.5112.101 and Fedora 37.

Q: What kind of attack does CVE-2022-2859 enable?

CVE-2022-2859 enables a remote attacker to exploit heap corruption through specific UI interactions.

Q: Is CVE-2022-2859 specific to any operating system?

CVE-2022-2859 is specific to Google Chrome running on any operating system it supports, including Fedora.

Published Jun 22, 2022

Updated

Use after free in Chrome OS Shell in Google Chrome prior to 104.0.5112.101 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via specific UI interactions.

Credit

Nan Wang@@eternalsakura13(360 Vulnerability Research Institute), Guang Gong(360 Vulnerability Research Institute)

Affected Software

3 affected componentsFixes available

Google Chrome<104.0.5112.101

104.0.5112.101

Google Chrome<104.0.5112.101

fedoraproject fedora=37

Remediation

Patch Available

https://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop_16.html

Event History

Jun 22, 2022

CVE Published

12:00 AM

Sep 26, 2022

CVE Published

via MITRE·03:01 PM

Data Sourced

via MITRE·03:01 PM

DescriptionWeakness

Data Sourced

via NVD·04:15 PM

RemedyDescriptionSeverityWeaknessAffected Software

Parent advisories

This vulnerability appears in the following advisories.

5720220590878638492

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

What is the severity of CVE-2022-2859?