Google · Chromium GPU
The heap buffer overflow flaw lies in the GPU component of Google Chromium, the open-source browser engine underlying Google Chrome. An attacker who has already compromised the renderer process can exploit it through a crafted HTML page to potentially escape the browser sandbox, and the attack requires user interaction, such as visiting that page.
Heap buffer overflow in GPU in Google Chrome prior to 107.0.5304.121 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
First seen exploited 3 days before it was disclosed.
CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.
7 fixes in electron over 18 months. The latest fix listed for electron is 25.0.0-alpha.2.
Malicious web page drives browser exploitation
via a crafted HTML page
Sandbox escape bypasses browser defense mechanisms
potentially perform a sandbox escape
CVE-specific rules are not available in this build. Search SigmaHQ ↗
These detect the technique in general, not this specific vulnerability.
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
1 package in 1 ecosystem. Main package: electron.
Upgrade to 19.1.8
Still affected on this line by CVE-2023-5217 (fixed in 22.3.25, a newer line).
npm install electron@19.1.8The first fix for CVE-2022-4135.
| If you run | Upgrade to |
|---|---|
| 19.0.0 up to 19.1.8 | 19.1.8 |
“Up to” means the second version is the fix and is not affected.
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.