Google Chrome up to 100.0.4896.87 WebGPU use after free

Summaryinfo

A vulnerability was found in Google Chrome up to 100.0.4896.87. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component WebGPU. The manipulation results in use after free. This vulnerability is known as CVE-2022-2399. It is possible to launch the attack remotely. No exploit is available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in Google Chrome up to 100.0.4896.87 (Web Browser). It has been classified as critical. Affected is some unknown processing of the component WebGPU. The manipulation with an unknown input leads to a use after free vulnerability. CWE is classifying the issue as CWE-416. Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Use after free in WebGPU in Google Chrome prior to 100.0.4896.88 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

The weakness was published 07/29/2022. The advisory is shared for download at chromereleases.googleblog.com. This vulnerability is traded as CVE-2022-2399 since 07/13/2022. Successful exploitation requires user interaction by the victim. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $5k-$25k (estimation calculated on 08/28/2022). It is expected to see the exploit prices for this product increasing in the near future.

Upgrading to version 100.0.4896.88 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Web Browser

Vendor

• Google

Name

• Chrome

Version

• 100.0.4896.0
• 100.0.4896.1
• 100.0.4896.2
• 100.0.4896.3
• 100.0.4896.4
• 100.0.4896.5
• 100.0.4896.6
• 100.0.4896.7
• 100.0.4896.8
• 100.0.4896.9
• 100.0.4896.10
• 100.0.4896.11
• 100.0.4896.12
• 100.0.4896.13
• 100.0.4896.14
• 100.0.4896.15
• 100.0.4896.16
• 100.0.4896.17
• 100.0.4896.18
• 100.0.4896.19
• 100.0.4896.20
• 100.0.4896.21
• 100.0.4896.22
• 100.0.4896.23
• 100.0.4896.24
• 100.0.4896.25
• 100.0.4896.26
• 100.0.4896.27
• 100.0.4896.28
• 100.0.4896.29
• 100.0.4896.30
• 100.0.4896.31
• 100.0.4896.32
• 100.0.4896.33
• 100.0.4896.34
• 100.0.4896.35
• 100.0.4896.36
• 100.0.4896.37
• 100.0.4896.38
• 100.0.4896.39
• 100.0.4896.40
• 100.0.4896.41
• 100.0.4896.42
• 100.0.4896.43
• 100.0.4896.44
• 100.0.4896.45
• 100.0.4896.46
• 100.0.4896.47
• 100.0.4896.48
• 100.0.4896.49
• 100.0.4896.50
• 100.0.4896.51
• 100.0.4896.52
• 100.0.4896.53
• 100.0.4896.54
• 100.0.4896.55
• 100.0.4896.56
• 100.0.4896.57
• 100.0.4896.58
• 100.0.4896.59
• 100.0.4896.60
• 100.0.4896.61
• 100.0.4896.62
• 100.0.4896.63
• 100.0.4896.64
• 100.0.4896.65
• 100.0.4896.66
• 100.0.4896.67
• 100.0.4896.68
• 100.0.4896.69
• 100.0.4896.70
• 100.0.4896.71
• 100.0.4896.72
• 100.0.4896.73
• 100.0.4896.74
• 100.0.4896.75
• 100.0.4896.76
• 100.0.4896.77
• 100.0.4896.78
• 100.0.4896.79
• 100.0.4896.80
• 100.0.4896.81
• 100.0.4896.82
• 100.0.4896.83
• 100.0.4896.84
• 100.0.4896.85
• 100.0.4896.86
• 100.0.4896.87

License

• free

Website

• Vendor: https://www.google.com/
• Product: https://www.google.com/chrome/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion