CVE-2022-1864 - Use after free in WebApp Installs in Google Chrome prior to 102.0.5005.61 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension and specific user interaction

Back Back to CVE browser

HIGH

Use after free in WebApp Installs in Google Chrome prior to 102.0.5005.61 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension and specific user interaction

Published Jul 27, 2022

8.8

HIGH

CVSS 3.1

EPSS 0.57%

Description

Use after free in WebApp Installs in Google Chrome prior to 102.0.5005.61 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension and specific user interaction.

Affected products

Vendor Google Product Chrome Default
unknown
Affected
- ≥ unspecified, < 102.0.5005.61

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Google	Chrome	unknown	Affected ≥ unspecified, < 102.0.5005.61

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-416

Use After Free

References (4)

https://chromereleases.googleblog.com/2022/05/stable-channel-update-for-desktop_24.html
x_refsource_MISCRelease NotesVendor Advisory
https://crbug.com/1320624
x_refsource_MISCPermissions RequiredVendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-25137
Advisory
https://security.gentoo.org/glsa/202208-25
vendor-advisoryx_refsource_GENTOOThird Party Advisory

Link	Providers	Tags
https://chromereleases.googleblog.com/2022/05/stable-channel-update-for-desktop_24.html		x_refsource_MISCRelease NotesVendor Advisory
https://crbug.com/1320624		x_refsource_MISCPermissions RequiredVendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-25137		Advisory
https://security.gentoo.org/glsa/202208-25		vendor-advisoryx_refsource_GENTOOThird Party Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner Chrome

Published Jul 27, 2022

Updated Aug 3, 2024

Reserved May 24, 2022

Link CVE-2022-1864

CISA Vulnrichment

No data

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2022-1864

Red Hat

No data

ENISA EUVD

Assigner Chrome

Published Jul 27, 2022

Updated Aug 3, 2024

Link EUVD-2022-25137

GitHub

No data