CVE-2022-4135: New Zero-Day Vulnerability in Google Chrome

by do son · Published November 24, 2022 · Updated November 27, 2022

Google on Thursday shipped emergency patches to address a security vulnerability in its Chrome web browser, which it says is being actively exploited in the wild.

Tracked as CVE-2022-4135, Google described the high-severity flaw as a heap buffer overflow in GPU. Clement Lecigne of Google’s Threat Analysis Group has been credited with reporting the flaw on November 22, 2022.

Buffer overflows often can be used to execute arbitrary code, which is usually outside the scope of a program’s implicit security policy. Besides important user data, heap-based overflows can be used to overwrite function pointers that may be living in memory, pointing it to the attacker’s code. Even in applications that do not explicitly use function pointers, the run-time will usually leave many in memory. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

The flaw allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.

“Google is aware that an exploit for CVE-2022-4135 exists in the wild,” the company noted in an advisory without delving into technical specifics about how the security vulnerability was used in attacks or the threat actors that may have weaponized it.

To ensure security, Google has released an emergency security update to fix this vulnerability, the corresponding version number is Google Chrome 107.0.5304.121 for Mac and Linux and 107.0.5304.121/.122 for Windows.

Users of Google Chrome can go to the About page of the settings, where they can see the current version number and can automatically check the latest version. If the user deploys the online installation package, it can be updated automatically. If the user deploys the offline installation package, the user needs to manually download the new version to upgrade. Users of Chromium-based browsers such as Microsoft Edge, Brave, Opera, and Vivaldi are also advised to apply the fixes as and when they become available.

CVE-2022-4135: New Zero-Day Vulnerability in Google Chrome

Search

Brilliantly

Content & Links