CVE-2022-3654
Published: 01 November 2022
Summary
CVE-2022-3654 is a high-severity Use After Free (CWE-416) vulnerability in Google Chrome. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 11.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
CVE-2022-3654 is a use-after-free vulnerability in the Layout component of Google Chrome, present in versions prior to 107.0.5304.62. The flaw, tracked under CWE-416, can result in heap corruption when processing a specially crafted HTML page and carries a CVSS 3.1 base score of 8.8.
A remote attacker can trigger the issue by causing a victim to visit a malicious web page, allowing potential exploitation of the resulting memory corruption to compromise confidentiality, integrity, and availability without requiring user privileges beyond rendering the page.
Chrome stable channel updates released on 25 October 2022 advise users to upgrade immediately to version 107.0.5304.62 or later to address the vulnerability. The associated EPSS score rose from a low baseline to a peak of 0.1614 on 2025-12-18 before receding to its current value of 0.0368, indicating a period of increased exploitation interest well after initial disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-43013
Vulnerability details
Use after free in Layout in Google Chrome prior to 107.0.5304.62 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Use-after-free exploits that achieve arbitrary code execution are blocked or significantly hardened by non-executable pages and ASLR.