CVE-2022-3055: Use after free in Passwords

Q: What is the severity of CVE-2022-3055?

CVE-2022-3055 is classified as a high-severity vulnerability due to its potential for exploitation via heap corruption.

Q: How do I fix CVE-2022-3055?

To remediate CVE-2022-3055, update Google Chrome to version 105.0.5195.52 or later.

Q: Which versions of Google Chrome are affected by CVE-2022-3055?

CVE-2022-3055 affects Google Chrome versions prior to 105.0.5195.52.

Q: Can CVE-2022-3055 be exploited by any type of attacker?

CVE-2022-3055 can be exploited by a remote attacker who convinces a user to engage in specific UI interactions.

Q: What type of vulnerability is CVE-2022-3055?

CVE-2022-3055 is a use after free vulnerability in the Passwords component of Google Chrome.

Published Aug 11, 2022

Updated

Use after free in Passwords in Google Chrome prior to 105.0.5195.52 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via a crafted HTML page.

Credit

Weipeng Jiang@@Krace(360 Vulnerability Research Institute), Guang Gong(360 Vulnerability Research Institute)

Affected Software

7 affected componentsFixes available

Google Chrome<105.0.5195.52

105.0.5195.52

Google Chrome<105.0.5195.52

Fedoraproject Fedora=37

debian/chromium<105.0.5195.52-1

105.0.5195.52-1

debian/chromium<105.0.5195.52-1

105.0.5195.52-1

debian/chromium<105.0.5195.52-1

105.0.5195.52-1

debian/chromium

150.0.7871.100-1~deb12u1156.0.8078.79-1~deb12u1150.0.7871.181-1~deb13u1156.0.8078.79-1~deb13u1156.0.8078.79-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Google Chrome (Trace Event) to a version that resolves this vulnerability.
Fixed in 105.0.5195.52
Upgrade
Upgrade debian/chromium to a version that resolves this vulnerability.
Fixed in 105.0.5195.52-1
Upgrade
Upgrade debian/chromium to a version that resolves this vulnerability.
Fixed in 150.0.7871.100-1~deb12u1Fixed in 156.0.8078.79-1~deb12u1Fixed in 150.0.7871.181-1~deb13u1Fixed in 156.0.8078.79-1~deb13u1Fixed in 156.0.8078.79-1

Event History

Aug 11, 2022

CVE Published

12:00 AM

Sep 26, 2022

CVE Published

via MITRE·03:01 PM

Data Sourced

via MITRE·03:01 PM

DescriptionWeakness

Data Sourced

via OSV·04:15 PM

DescriptionSeverityAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

What is the severity of CVE-2022-3055?

CVE-2022-3055 is classified as a high-severity vulnerability due to its potential for exploitation via heap corruption.

How do I fix CVE-2022-3055?

To remediate CVE-2022-3055, update Google Chrome to version 105.0.5195.52 or later.

Which versions of Google Chrome are affected by CVE-2022-3055?

CVE-2022-3055 affects Google Chrome versions prior to 105.0.5195.52.

Can CVE-2022-3055 be exploited by any type of attacker?

CVE-2022-3055 can be exploited by a remote attacker who convinces a user to engage in specific UI interactions.

What type of vulnerability is CVE-2022-3055?

CVE-2022-3055 is a use after free vulnerability in the Passwords component of Google Chrome.

CVE-2022-3055: Use after free in Passwords

Credit

Affected Software

Remediation

Event History

Parent advisories

Peer vulnerabilities

Frequently Asked Questions

What is the severity of CVE-2022-3055?

How do I fix CVE-2022-3055?

Which versions of Google Chrome are affected by CVE-2022-3055?

Can CVE-2022-3055 be exploited by any type of attacker?

What type of vulnerability is CVE-2022-3055?

Company

Resources

Contact