CVE-2022-3658: Use after free in Feedback service on Chrome OS

Q: What is CVE-2022-3658?

CVE-2022-3658 is a vulnerability that allows an attacker who convinced a user to install a malicious extension on Google Chrome OS prior to version 107.0.5304.62 to potentially exploit heap corruption via specific UI interaction.

Q: What is the severity of CVE-2022-3658?

The severity of CVE-2022-3658 is Medium (8.8 out of 10).

Q: How can an attacker exploit CVE-2022-3658?

An attacker can exploit CVE-2022-3658 by convincing a user to install a malicious extension and then performing specific UI interactions to trigger heap corruption.

Q: Which software versions are affected by CVE-2022-3658?

Google Chrome on Chrome OS prior to version 107.0.5304.62 is affected by CVE-2022-3658.

Q: How can I fix CVE-2022-3658?

To fix CVE-2022-3658, update your Google Chrome browser on Chrome OS to version 107.0.5304.62 or later.

Published Aug 14, 2022

Updated

Use after free in Feedback service on Chrome OS in Google Chrome on Chrome OS prior to 107.0.5304.62 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via specific UI interaction. (Chromium security severity: Medium)

Credit

Nan Wang@@eternalsakura13(360 Vulnerability Research Institute), Guang Gong(360 Vulnerability Research Institute)

Affected Software

7 affected componentsFixes available

Google Chrome<107.0.5304.62

107.0.5304.62

Google Chrome<107.0.5304.62

Google Chrome OS

debian/chromium<107.0.5304.68-1

107.0.5304.68-1

debian/chromium<107.0.5304.68-1

107.0.5304.68-1

debian/chromium<107.0.5304.68-1

107.0.5304.68-1

debian/chromium

150.0.7871.100-1~deb12u1156.0.8078.79-1~deb12u1150.0.7871.181-1~deb13u1156.0.8078.79-1~deb13u1156.0.8078.79-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Google Chrome (Trace Event) to a version that resolves this vulnerability.
Fixed in 107.0.5304.62
Upgrade
Upgrade debian/chromium to a version that resolves this vulnerability.
Fixed in 107.0.5304.68-1
Upgrade
Upgrade debian/chromium to a version that resolves this vulnerability.
Fixed in 150.0.7871.100-1~deb12u1Fixed in 156.0.8078.79-1~deb12u1Fixed in 150.0.7871.181-1~deb13u1Fixed in 156.0.8078.79-1~deb13u1Fixed in 156.0.8078.79-1
Upgrade
Upgrade Google Chrome on Chrome OS to a version that resolves this vulnerability.
Fixed in 107.0.5304.62

Event History

Aug 14, 2022

CVE Published

12:00 AM

Nov 1, 2022

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

DescriptionWeakness

Data Sourced

via OSV·11:15 PM

DescriptionSeverityAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

What is CVE-2022-3658?

CVE-2022-3658 is a vulnerability that allows an attacker who convinced a user to install a malicious extension on Google Chrome OS prior to version 107.0.5304.62 to potentially exploit heap corruption via specific UI interaction.

What is the severity of CVE-2022-3658?

The severity of CVE-2022-3658 is Medium (8.8 out of 10).

How can an attacker exploit CVE-2022-3658?

An attacker can exploit CVE-2022-3658 by convincing a user to install a malicious extension and then performing specific UI interactions to trigger heap corruption.

Which software versions are affected by CVE-2022-3658?

Google Chrome on Chrome OS prior to version 107.0.5304.62 is affected by CVE-2022-3658.

How can I fix CVE-2022-3658?

To fix CVE-2022-3658, update your Google Chrome browser on Chrome OS to version 107.0.5304.62 or later.

CVE-2022-3658: Use after free in Feedback service on Chrome OS

Credit

Affected Software

Remediation

Event History

Parent advisories

Peer vulnerabilities

Frequently Asked Questions

What is CVE-2022-3658?

What is the severity of CVE-2022-3658?

How can an attacker exploit CVE-2022-3658?

Which software versions are affected by CVE-2022-3658?

How can I fix CVE-2022-3658?

Company

Resources

Contact