CVE-2022-2742
published 2023-01-02CVE-2022-2742: Use after free in Exosphere in Google Chrome on Chrome OS and Lacros prior to 104.0.5112.79 allowed a remote attacker who convinced a user to engage in…
PriorityP344high8.8CVSS 3.1
AVNACLPRNUIRSUCHIHAH
EPSS
0.40%
32.2th percentile
Use after free in Exosphere in Google Chrome on Chrome OS and Lacros prior to 104.0.5112.79 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via crafted UI interactions. (Chrome security severity: High)
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| chromium | chromium | >= 0 < 104.0.5112.79-1~deb11u1 | 104.0.5112.79-1~deb11u1 |
| chromium | chromium | >= 0 < 104.0.5112.79-1 | 104.0.5112.79-1 |
| chromium | chromium | >= 0 < 104.0.5112.79-1 | 104.0.5112.79-1 |
| chromium | chromium | >= 0 < 104.0.5112.79-1 | 104.0.5112.79-1 |
| debian | chromium | < chromium 104.0.5112.79-1 (bookworm) | chromium 104.0.5112.79-1 (bookworm) |
| chrome | < 104.0.5112.79 | 104.0.5112.79 | |
| chrome | >= unspecified < 104.0.5112.79 | 104.0.5112.79 |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
osv8.8HIGH
vendor_debian8.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Google Chrome up to 103.0.5060.134 on Chrome OS/Lacros Exosphere use after free (EUVD-2022-34984)
vuldb·2026-05-27·CVSS 8.8
CVE-2022-2742 [HIGH] Google Chrome up to 103.0.5060.134 on Chrome OS/Lacros Exosphere use after free (EUVD-2022-34984)
A vulnerability was found in Google Chrome on Chrome OS/Lacros. It has been declared as critical. The impacted element is an unknown function of the component Exosphere. Such manipulation leads to use after free.
This vulnerability is uniquely identified as CVE-2022-2742. The attack can be launched remotely. No exploit exists.
It is recommended to upgrade the affected component.
GHSA
GHSA-5c97-rvp5-w97q: Use after free in Exosphere in Google Chrome on Chrome OS and Lacros prior to 104
ghsa_unreviewed·2023-01-03
CVE-2022-2742 [HIGH] CWE-362 GHSA-5c97-rvp5-w97q: Use after free in Exosphere in Google Chrome on Chrome OS and Lacros prior to 104
Use after free in Exosphere in Google Chrome on Chrome OS and Lacros prior to 104.0.5112.79 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via crafted UI interactions. (Chrome security severity: High)
OSV
CVE-2022-2742: Use after free in Exosphere in Google Chrome on Chrome OS and Lacros prior to 104
osv·2023-01-02·CVSS 8.8
CVE-2022-2742 [HIGH] CVE-2022-2742: Use after free in Exosphere in Google Chrome on Chrome OS and Lacros prior to 104
Use after free in Exosphere in Google Chrome on Chrome OS and Lacros prior to 104.0.5112.79 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via crafted UI interactions. (Chrome security severity: High)
Debian
CVE-2022-2742: chromium - Use after free in Exosphere in Google Chrome on Chrome OS and Lacros prior to 10...
vendor_debian·2022·CVSS 8.8
CVE-2022-2742 [HIGH] CVE-2022-2742: chromium - Use after free in Exosphere in Google Chrome on Chrome OS and Lacros prior to 10...
Use after free in Exosphere in Google Chrome on Chrome OS and Lacros prior to 104.0.5112.79 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via crafted UI interactions. (Chrome security severity: High)
Scope: local
bookworm: resolved (fixed in 104.0.5112.79-1)
bullseye: resolved (fixed in 104.0.5112.79-1~deb11u1)
forky: resolved (fixed in 104.0.5112.79-1)
sid: resolved (fixed in 104.0.5112.79-1)
trixie: resolved (fixed in 104.0.5112.79-1)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2023-01-02
Published