CVE-2022-4135
Google Chromium GPU Heap Buffer Overflow Vulnerability
Description
CVE-2022-4135 is a critical heap buffer overflow vulnerability in the GPU component of Google Chrome prior to version 107.0.5304.121. This out-of-bounds write flaw allows a remote attacker who has already compromised the renderer process to potentially escape the Chrome sandbox through a crafted HTML page. With a CVSS score of 9.6 (Critical) and confirmed active exploitation in the wild, CVE-2022-4135 represents a serious threat as it can break Chrome's primary security boundary. CISA has added this Google Chrome heap buffer overflow vulnerability to its Known Exploited Vulnerabilities catalog, and browsers based on Chromium, including Microsoft Edge, are also affected.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| chrome | < 107.0.5304.121 | |
| microsoft | edge | < 107.0.1418.62 |
| microsoft | edge chromium | < 107.0.5304.150 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
References
- https://chromereleases.googleblog.com/2022/11/stable-channel-update-for-desktop_24.html(Release Notes, Vendor Advisory)
- https://crbug.com/1392715(Exploit, Issue Tracking)
- https://security.gentoo.org/glsa/202305-10(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-4135(US Government Resource)
Weakness Type
CWE-787: Out-of-bounds Write
In the context of CVE-2022-4135, the GPU process in Google Chrome contains a heap buffer overflow that allows writing data beyond the allocated memory buffer. This out-of-bounds write weakness in Chrome's GPU component can be triggered via crafted HTML content, enabling an attacker who has already compromised the renderer process to corrupt heap memory and potentially achieve sandbox escape.
Learn more: CWE-787 — Out-of-bounds Write
Impact Analysis
CVE-2022-4135 is remotely exploitable without physical access and with low attack complexity, requiring user interaction only in the form of visiting a malicious web page. No authentication or privileges are required from the victim's perspective, though the attacker must first compromise the renderer process. Critically, the scope is changed, meaning this vulnerability can affect resources beyond the vulnerable GPU component, specifically enabling sandbox escape. Confidentiality (High): A successful sandbox escape grants the attacker access to the underlying operating system, exposing all user data, files, and credentials beyond the browser's isolated environment. Integrity (High): With sandbox escape, the attacker can execute arbitrary code at the operating system level, install malware, and modify system files. Availability (High): Full system compromise can result in denial of service, ransomware deployment, or persistent backdoor installation. The CVSS score of 9.6 (Critical) reflects the devastating impact of sandbox escape, and the confirmed active exploitation underscores the immediate danger to unpatched users of Google Chrome and Microsoft Edge.
Exploit Maturity
Public exploit information is available for CVE-2022-4135 via the Chromium bug tracker, which is tagged as an exploit reference. CISA has confirmed active exploitation of this vulnerability in the wild and has included it in the Known Exploited Vulnerabilities catalog with a remediation deadline of December 19, 2022. Google acknowledged that an exploit for CVE-2022-4135 existed in the wild at the time of the patch release. Despite the low EPSS score of 0.14% (34th percentile), the confirmed in-the-wild exploitation indicates this was likely used in targeted attacks rather than mass exploitation campaigns.
Remediation
- Update Google Chrome immediately to version 107.0.5304.121 or later, as directed by CISA: "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable." The fix is documented in the Chrome stable channel update.
- Update Microsoft Edge and other Chromium-based browsers including Brave, Opera, and Vivaldi to their respective patched versions that incorporate the Chromium GPU fix. Microsoft Edge Chromium versions are also listed as affected.
- Enforce browser update policies across your organization using enterprise management tools to ensure all Chromium-based browsers are patched promptly. Consider implementing browser version compliance checks that flag endpoints running vulnerable versions.
- Monitor endpoint detection logs for indicators of sandbox escape attempts, including unusual child process creation from browser GPU processes, unexpected privilege escalation, and suspicious file system access originating from browser components.
- Implement defense-in-depth measures including operating system-level exploit mitigations (ASLR, DEP, CFI), endpoint detection and response (EDR) solutions, and application whitelisting to limit the impact of successful sandbox escape through heap buffer overflow exploitation.
Technical Details
CVE-2022-4135 is a heap buffer overflow (CWE-787, out-of-bounds write) in the GPU process of Google Chrome prior to version 107.0.5304.121. The vulnerability occurs when the GPU process improperly handles memory allocation, allowing data to be written beyond the boundaries of a heap-allocated buffer during GPU rendering operations triggered by crafted HTML content. As indicated by the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), the attack requires network access and user interaction (visiting a malicious page), but notably the scope is changed (S:C), reflecting the ability to escape Chrome's sandbox boundary. The attacker must first compromise the renderer process (through a separate vulnerability or exploit chain) before leveraging this GPU heap buffer overflow to escape the sandbox. The heap corruption allows the attacker to overwrite critical data structures in the GPU process memory space, ultimately gaining code execution outside the sandboxed environment and achieving operating system-level access.
Frequently Asked Questions
Is CVE-2022-4135 being actively exploited?
Yes, CVE-2022-4135 is being actively exploited in the wild. CISA has included it in the Known Exploited Vulnerabilities catalog with a remediation deadline of December 19, 2022. Google confirmed that an exploit existed in the wild at the time of the patch release.
What products are affected by CVE-2022-4135?
CVE-2022-4135 affects Google Chrome versions prior to 107.0.5304.121, Microsoft Edge, and Microsoft Edge Chromium. Any browser based on the Chromium engine that uses the affected GPU component may be vulnerable.
How do I fix CVE-2022-4135?
Update Google Chrome to version 107.0.5304.121 or later, and update all other Chromium-based browsers including Microsoft Edge to their corresponding patched versions. Enable automatic browser updates to ensure timely deployment of security fixes. See the Remediation section for complete guidance.
How severe is CVE-2022-4135?
CVE-2022-4135 is rated Critical with a CVSS score of 9.6 out of 10. The scope-changed designation means successful exploitation can escape the browser sandbox and affect the underlying operating system. Despite a lower EPSS score of 0.14%, the confirmed active exploitation and sandbox escape capability make this an extremely high-priority vulnerability.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.