cbcvebase.
CVE-2022-0609
published 2022-04-05

CVE-2022-0609: Use after free in Animation in Google Chrome prior to 98.0.4758.102 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

PriorityP189high8.8CVSS 3.1
AVNACLPRNUIRSUCHIHAH
KEVITWRansomware
CISA Known Exploited Vulnerabilitydue 2022-03-01
Exploited in the wild
EPSS
23.55%
97.5th percentile
Use after free in Animation in Google Chrome prior to 98.0.4758.102 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Affected

9 ranges
VendorProductVersion rangeFixed in
chromiumchromium>= 0 < 98.0.4758.102-1~deb11u198.0.4758.102-1~deb11u1
chromiumchromium>= 0 < 98.0.4758.102-198.0.4758.102-1
chromiumchromium>= 0 < 98.0.4758.102-198.0.4758.102-1
chromiumchromium>= 0 < 98.0.4758.102-198.0.4758.102-1
debianchromium< chromium 98.0.4758.102-1 (bookworm)chromium 98.0.4758.102-1 (bookworm)
googlechrome< 98.0.4758.10298.0.4758.102
googlechrome>= unspecified < 98.0.4758.10298.0.4758.102
googlechrome_chrome
msrcmicrosoft_edge

Detection & IOCsextracted from sources · hover to see the quote

  • Exploit delivered via hidden iframes embedded in both compromised legitimate websites and attacker-owned websites, serving a multi-stage exploit kit targeting Chrome users
  • Initial stage of exploit kit serves heavily obfuscated JavaScript that fingerprints the target by collecting user-agent, resolution, and other client info before sending to exploitation server — detect anomalous JS fingerprinting beacons
  • Attackers specifically checked visitor browser/OS combinations (Safari on macOS, Firefox on any OS) and redirected them to separate known exploitation servers — monitor for server-side browser/OS conditional redirects from suspicious pages
  • CVE-2022-0609 is actively exploited in the wild; patch Chrome to version 98.0.4758.102 or later and Microsoft Edge to 98.0.1108.55 or later to remediate
  • ·The specific requirements checked server-side before serving the RCE exploit are unknown, limiting the ability to fully replicate or simulate the attack chain

CVSS provenance

nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
ghsa8.8HIGH
osv8.8HIGH
vulncheck8.8HIGH
cisa8.8HIGH
vendor_debian8.8HIGH
vendor_msrc8.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.