CVE-2022-3049

Severity Score

8.8

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Use after free in SplitScreen in Google Chrome on Chrome OS, Lacros prior to 105.0.5195.52 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via a crafted HTML page.

Un uso de memoria previamente liberada en SplitScreen en Google Chrome en Chrome OS, Lacros versiones anteriores a 105.0.5195.52, permitió a un atacante remoto que convenció a un usuario de participar en interacciones específicas de la Interfaz de Usuario específicos para explotar potencialmente una corrupción de la pila por medio de una página HTML diseñada.

*Credits: N/A

CVSS Scores

NISTv3.1 8.8

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2022-08-30 CVE Reserved
2022-09-26 CVE Published
2024-05-17 EPSS Updated
2024-08-03 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CAPEC

References (3)

URL	Tag	Source

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
https://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop_30.html	2023-11-07
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4NMJURTG5RO3TGD7ZMIQ6Z4ZZ3SAVYE	2023-11-07
https://security.gentoo.org/glsa/202209-23	2023-11-07

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Google Search vendor "Google"	Chrome Search vendor "Google" for product "Chrome"	< 105.0.5195.52 Search vendor "Google" for product "Chrome" and version " < 105.0.5195.52"	-	Affected	in	Google Search vendor "Google"	Chrome Os Search vendor "Google" for product "Chrome Os"	-	-	Safe
Google Search vendor "Google"	Chrome Search vendor "Google" for product "Chrome"	< 105.0.5195.52 Search vendor "Google" for product "Chrome" and version " < 105.0.5195.52"	-	Affected	in	Google Search vendor "Google"	Linux And Chrome Os Search vendor "Google" for product "Linux And Chrome Os"	-	-	Safe
Fedoraproject Search vendor "Fedoraproject"		Fedora Search vendor "Fedoraproject" for product "Fedora"				37 Search vendor "Fedoraproject" for product "Fedora" and version "37"		-		Affected