CVE-2022-1145 — Use After Free in Google Chrome

CWE-416 — Use After FreeCWE-911 — Improper Update of Reference Count9 documents8 sources
Severity
7.5HIGHNVD
EPSS
0.2%
top 53.81%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
6
Google ChromeChromiumLinux Kernel+3 more
Timeline
PublishedJul 23
Latest updateDec 24

Description

Use after free in Extensions in Google Chrome prior to 100.0.4896.60 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via specific user interaction and profile destruction.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 1.6 | Impact: 5.9

Affected Packages7 packages

▶CVEListV5google/chromeunspecified — 100.0.4896.60
▶NVDgoogle/chrome< 100.0.4896.60
▶debiandebian/chromium< chromium 100.0.4896.60-1 (bookworm)
▶Linuxlinux/linux_kernel4.2.0 — 4.9.337+7

Patches

Patch: crbug.com ↗Patch: crbug.com ↗

🔴Vulnerability Details

3
OSV
udf: Avoid double brelse() in udf_rename()↗2025-12-24
▶
GHSA
GHSA-w77j-2gh3-6mvp: Use after free in Extensions in Google Chrome prior to 100↗2022-07-24
▶
OSV
CVE-2022-1145: Use after free in Extensions in Google Chrome prior to 100↗2022-07-23
▶

📋Vendor Advisories

4
Red Hat
kernel: Linux kernel UDF filesystem: Denial of Service due to memory corruption during rename operations↗2025-12-24
▶
Chrome
Long Term Support Channel Update: CVE-2022-1142↗2022-04-15
▶
Microsoft
Chromium: CVE-2022-1145 Use after free in Extensions↗2022-04-12
▶
Debian
CVE-2022-1145: chromium - Use after free in Extensions in Google Chrome prior to 100.0.4896.60 allowed an ...↗2022
▶