CVE-2022-0609: high-severity vulnerability in Google Chrome
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA.
Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.
Apply updates per vendor instructions.
Google Chrome's Animation feature had a memory bug where freed memory could be reused, allowing attackers to crash the browser or potentially execute code by visiting a malicious website.
Use-after-free vulnerability in Chrome's Animation component (CWE-416) enables remote code execution or heap corruption when processing crafted HTML. Attack vector is web-based (requires user to visit malicious page); no authentication needed. Pre-condition: victim must use Chrome < 98.0.4758.102.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.