Executive brief
Google Chrome contains a heap buffer overflow vulnerability in the GPU rendering engine that affects versions prior to 107.0.5304.121. A remote attacker who has already compromised the browser's renderer process can exploit this flaw to escape the sandbox and gain arbitrary code execution on the underlying system. While requiring an initial compromise of the renderer process, successful exploitation could lead to complete system takeover.
Technical details
This is a heap buffer overflow (CWE-787) in the GPU component of the Chromium/Chrome rendering engine affecting the command decoder validation logic. The vulnerability requires a compromised renderer process and a crafted HTML page to trigger. The attack allows an attacker to write beyond allocated heap memory bounds, enabling potential sandbox escape from the renderer process to the broader system. The fix was introduced in Chrome 107.0.5304.121 and backported to Electron 19.1.8 and 20.x branches. The vulnerability was classified as High severity by the Chromium security team.
Affected products
- Google Chrome prior to 107.0.5304.121
- Electron Electron 19.0.0 to 19.1.7, 20.x prior to fix
Timeline
- 2022-11-25: disclosed: Vulnerability published in NVD and GitHub Advisory Database
- 2022-11-24: patched: Fix released in Chrome 107.0.5304.121