CVE-2022-4135: critical vulnerability in Google Chrome
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA.
Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.
Apply updates per vendor instructions.
A memory overflow flaw in Chrome's GPU component allowed attackers who compromised the browser's renderer to escape the sandbox and gain full system access. This is critical because it enables attackers to break out of Chrome's security isolation.
Heap buffer overflow in the GPU command processing pipeline (CWE-787) in Chrome versions prior to 107.0.5304.121. Requires prior renderer process compromise as precondition; triggered via crafted HTML page. Impacts confidentiality, integrity, and availability through sandbox escape.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.