CVE-2022-3038
Published: 26 September 2022
Summary
CVE-2022-3038 is a high-severity Use After Free (CWE-416) vulnerability in Google Chrome. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 2.8% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2022-3038 is a use-after-free vulnerability in the Network Service component of Google Chrome versions prior to 105.0.5195.52. The flaw, tracked as CWE-416, can result in heap corruption when a victim visits a specially crafted HTML page, carrying a CVSS 3.1 base score of 8.8.
A remote attacker can trigger the issue without authentication by serving malicious web content that the browser renders, potentially allowing arbitrary code execution with the privileges of the Chrome renderer process and full read/write access to the victim’s browser memory.
Chrome stable channel updates released on 30 August 2022 and subsequent distribution advisories from Fedora and Gentoo direct users to upgrade immediately to version 105.0.5195.52 or later; the referenced Chromium bug report and exploit artifacts confirm the fix was backported into the stable branch.
The associated EPSS score reached a peak of 0.4655 before settling at the current value of 0.3599.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-42470
Vulnerability details
Use after free in Network Service in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- CWE(s)
- KEV Date Added
- 30 March 2023
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires timely application of security-relevant patches, which is the vendor-supplied fix (Chrome ≥105.0.5195.52) that eliminates the use-after-free.
Mandates memory-protection techniques that block exploitation of use-after-free conditions such as the heap corruption described in CVE-2022-3038.
Enforces least-functionality restrictions on browser features and network-service components that could otherwise be abused by the crafted HTML page.