CVE-2022-4920
published 2023-07-29CVE-2022-4920: Heap buffer overflow in Blink in Google Chrome prior to 101.0.4951.41 allowed a remote attacker who convinced a user to engage in specific UI gestures to…
PriorityP348critical9.6CVSS 3.1
AVNACLPRNUIRSCCHIHAH
EPSS
0.75%
51.3th percentile
Heap buffer overflow in Blink in Google Chrome prior to 101.0.4951.41 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| chromium | chromium | >= 0 < 101.0.4951.41-1~deb11u1 | 101.0.4951.41-1~deb11u1 |
| chromium | chromium | >= 0 < 101.0.4951.41-1 | 101.0.4951.41-1 |
| chromium | chromium | >= 0 < 101.0.4951.41-1 | 101.0.4951.41-1 |
| chromium | chromium | >= 0 < 101.0.4951.41-1 | 101.0.4951.41-1 |
| debian | chromium | < chromium 101.0.4951.41-1 (bookworm) | chromium 101.0.4951.41-1 (bookworm) |
| chrome | < 101.0.4951.41 | 101.0.4951.41 | |
| chrome | >= 101.0.4951.41 < 101.0.4951.41 | 101.0.4951.41 | |
| chrome_chrome | — | — |
CVSS provenance
nvdv3.19.6CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
osv9.6CRITICAL
vendor_debian9.6CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Chrome
Stable Channel Update for Desktop: CVE-2022-4920
vendor_chrome·2022-04-26·CVSS 8.8
CVE-2022-4920 [HIGH] Stable Channel Update for Desktop: CVE-2022-4920
Stable Channel Update for Desktop
CVE-2022-4920: Heap buffer overflow in Blink. Reported by Shih-Fong Peng (@_L4ys) of TrapaSecurity on 2022-03-16 [$5000][ 1302949 ] High CVE-2022-1481: Use after free in Sharing
Reported by Weipeng Jiang (@Krace) and Guang Gong of 360 Vulnerability Research Institute on 2022-03-04 [$7500][ 1313709 ] High CVE-2022-1919: Use after free in Codecs
Severity: high
Debian
CVE-2022-4920: chromium - Heap buffer overflow in Blink in Google Chrome prior to 101.0.4951.41 allowed a ...
vendor_debian·2022·CVSS 9.6
CVE-2022-4920 [CRITICAL] CVE-2022-4920: chromium - Heap buffer overflow in Blink in Google Chrome prior to 101.0.4951.41 allowed a ...
Heap buffer overflow in Blink in Google Chrome prior to 101.0.4951.41 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
Scope: local
bookworm: resolved (fixed in 101.0.4951.41-1)
bullseye: resolved (fixed in 101.0.4951.41-1~deb11u1)
forky: resolved (fixed in 101.0.4951.41-1)
sid: resolved (fixed in 101.0.4951.41-1)
trixie: resolved (fixed in 101.0.4951.41-1)
OSV
CVE-2022-4920: Heap buffer overflow in Blink in Google Chrome prior to 101
osv·2023-07-29·CVSS 9.6
CVE-2022-4920 [CRITICAL] CVE-2022-4920: Heap buffer overflow in Blink in Google Chrome prior to 101
Heap buffer overflow in Blink in Google Chrome prior to 101.0.4951.41 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
GHSA
GHSA-vg57-hwh2-c85p: Heap buffer overflow in Blink in Google Chrome prior to 101
ghsa_unreviewed·2023-07-29
CVE-2022-4920 [CRITICAL] CWE-122 GHSA-vg57-hwh2-c85p: Heap buffer overflow in Blink in Google Chrome prior to 101
Heap buffer overflow in Blink in Google Chrome prior to 101.0.4951.41 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://chromereleases.googleblog.com/2022/04/stable-channel-update-for-desktop_26.htmlhttps://crbug.com/1306861https://lists.fedoraproject.org/archives/list/[email protected]/message/PQKT7EGDD2P3L7S3NXEDDRCPK4NNZNWJ/https://lists.fedoraproject.org/archives/list/[email protected]/message/YKLJ3B3D5BCVWE3QNP4N7HHF26OHD567/https://chromereleases.googleblog.com/2022/04/stable-channel-update-for-desktop_26.htmlhttps://crbug.com/1306861https://lists.fedoraproject.org/archives/list/[email protected]/message/PQKT7EGDD2P3L7S3NXEDDRCPK4NNZNWJ/https://lists.fedoraproject.org/archives/list/[email protected]/message/YKLJ3B3D5BCVWE3QNP4N7HHF26OHD567/
2023-07-29
Published