CVE-2022-4135: Google Chrome heap buffer overflow in GPU

CVE-2022-4135 · Severity: critical · CVSS 3.1 · Exploited in the wild · Published 2022-11-25

Google Chrome contains a heap buffer overflow vulnerability in the GPU rendering engine that affects versions prior to 107.0.5304.121. A remote attacker who has already compromised the browser's renderer process can exploit this flaw to escape the sandbox and gain arbitrary code execution on the underlying system. While requiring an initial compromise of the renderer process, successful exploitation could lead to complete system takeover.

Technologies: Google Chrome, electron (npm). Vendors: Google, npm.

Quick answers

Is CVE-2022-4135 exploited in the wild?
Yes. CVE-2022-4135 is known to be exploited in the wild, first recorded on 28 November 2022. Treat it as urgent.
How severe is CVE-2022-4135?
Critical severity, with a CVSS score of 3.1, published 25 November 2022.
Which products and versions are affected?
Google Chrome prior to 107.0.5304.121; electron (npm) SEMVER:introduced=19.0.0,fixed=19.1.8.
Is there a fix for CVE-2022-4135?
Yes. electron (npm): upgrade to 19.1.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2022-4135 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2022-4135?
Check whether you run Google Chrome, Google Chromium GPU or electron (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • electron (npm): upgrade to 19.1.8 or later
    npm install electron@19.1.8

Technical details

This is a heap buffer overflow (CWE-787) in the GPU component of the Chromium/Chrome rendering engine affecting the command decoder validation logic. The vulnerability requires a compromised renderer process and a crafted HTML page to trigger. The attack allows an attacker to write beyond allocated heap memory bounds, enabling potential sandbox escape from the renderer process to the broader system. The fix was introduced in Chrome 107.0.5304.121 and backported to Electron 19.1.8 and 20.x branches. The vulnerability was classified as High severity by the Chromium security team.

Affected products

  • Google Chrome prior to 107.0.5304.121
  • Electron Electron 19.0.0 to 19.1.7, 20.x prior to fix

Identifiers

  • CVE-2022-4135
  • GHSA-995f-9x5r-2rcj

Timeline

  • 2022-11-25: disclosed: Vulnerability published in NVD and GitHub Advisory Database
  • 2022-11-24: patched: Fix released in Chrome 107.0.5304.121

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.