CVE-2022-3842
Published: 02 January 2023
Summary
CVE-2022-3842 is a high-severity Use After Free (CWE-416) vulnerability in Google Chrome. Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 13.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
CVE-2022-3842 is a use-after-free vulnerability in the Passwords component of Google Chrome versions prior to 105.0.5195.125. The flaw, assigned CWE-416 and rated High severity by Chromium, resides in renderer process handling and can lead to heap corruption when triggered by a specially crafted HTML page.
A remote attacker who has already compromised the renderer process can exploit the issue to achieve arbitrary code execution or other impacts within the affected browser instance. The CVSS 7.5 vector reflects network attack reach, high complexity, no required privileges, and user interaction via a rendered page, resulting in high confidentiality, integrity, and availability consequences.
Chrome stable channel updates released on 14 September 2022 address the vulnerability by updating to version 105.0.5195.125 or later; the corresponding Chromium bug report provides additional technical detail on the fix.
EPSS for the CVE rose from a low baseline to a peak of 0.2324 on 2025-12-11 before receding to the current value of 0.0301, indicating a period of increased exploitation interest after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-43182
Vulnerability details
Use after free in Passwords in Google Chrome prior to 105.0.5195.125 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Use-after-free exploits that achieve arbitrary code execution are blocked or significantly hardened by non-executable pages and ASLR.