CVE-2022-3318: Use after free in ChromeOS Notifications

Q: What is the severity of CVE-2022-3318?

The severity of CVE-2022-3318 is medium (4.3).

Q: How does CVE-2022-3318 affect Google Chrome OS?

CVE-2022-3318 does not affect Google Chrome OS.

Q: What is the recommended version of Chromium to fix CVE-2022-3318 on Debian?

The recommended versions of Chromium to fix CVE-2022-3318 on Debian are 116.0.5845.180-1~deb11u1, 118.0.5993.70-1~deb11u1, 116.0.5845.180-1~deb12u1, and 118.0.5993.70-1~deb12u1.

Q: What is the affected version of Google Chrome for CVE-2022-3318?

The affected version of Google Chrome for CVE-2022-3318 is prior to 106.0.5249.62.

Q: Is there any remote exploitation risk associated with CVE-2022-3318?

Yes, there is a remote exploitation risk associated with CVE-2022-3318.

Published Apr 22, 2022

Updated

Use after free in ChromeOS Notifications in Google Chrome on ChromeOS prior to 106.0.5249.62 allowed a remote attacker who convinced a user to reboot Chrome OS to potentially exploit heap corruption via UI interaction. (Chromium security severity: Low)

Credit

GraVity0

Affected Software

7 affected componentsFixes available

Google Chrome<106.0.5249.61

106.0.5249.61

Google Chrome<106.0.5249.62

Google Chrome OS

debian/chromium<106.0.5249.61-1

106.0.5249.61-1

debian/chromium<106.0.5249.61-1

106.0.5249.61-1

debian/chromium<106.0.5249.61-1

106.0.5249.61-1

debian/chromium

150.0.7871.100-1~deb12u1156.0.8078.79-1~deb12u1150.0.7871.181-1~deb13u1156.0.8078.79-1~deb13u1156.0.8078.79-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Google Chrome (Trace Event) to a version that resolves this vulnerability.
Fixed in 106.0.5249.61
Upgrade
Upgrade debian/chromium to a version that resolves this vulnerability.
Fixed in 106.0.5249.61-1
Upgrade
Upgrade debian/chromium to a version that resolves this vulnerability.
Fixed in 150.0.7871.100-1~deb12u1Fixed in 156.0.8078.79-1~deb12u1Fixed in 150.0.7871.181-1~deb13u1Fixed in 156.0.8078.79-1~deb13u1Fixed in 156.0.8078.79-1
Upgrade
Upgrade Google Chrome on ChromeOS to a version that resolves this vulnerability.
Fixed in 106.0.5249.62

Event History

Apr 22, 2022

CVE Published

12:00 AM

Nov 1, 2022

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

DescriptionWeakness

Data Sourced

via OSV·08:15 PM

DescriptionSeverityAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

What is the severity of CVE-2022-3318?

The severity of CVE-2022-3318 is medium (4.3).

How does CVE-2022-3318 affect Google Chrome OS?

CVE-2022-3318 does not affect Google Chrome OS.

What is the recommended version of Chromium to fix CVE-2022-3318 on Debian?

The recommended versions of Chromium to fix CVE-2022-3318 on Debian are 116.0.5845.180-1~deb11u1, 118.0.5993.70-1~deb11u1, 116.0.5845.180-1~deb12u1, and 118.0.5993.70-1~deb12u1.

What is the affected version of Google Chrome for CVE-2022-3318?

The affected version of Google Chrome for CVE-2022-3318 is prior to 106.0.5249.62.

Is there any remote exploitation risk associated with CVE-2022-3318?

Yes, there is a remote exploitation risk associated with CVE-2022-3318.

CVE-2022-3318: Use after free in ChromeOS Notifications

Credit

Affected Software

Remediation

Event History

Parent advisories

Peer vulnerabilities

Frequently Asked Questions

What is the severity of CVE-2022-3318?

How does CVE-2022-3318 affect Google Chrome OS?

What is the recommended version of Chromium to fix CVE-2022-3318 on Debian?

What is the affected version of Google Chrome for CVE-2022-3318?

Is there any remote exploitation risk associated with CVE-2022-3318?

Company

Resources

Contact