Exploited vulnerability · CISA KEV

Is CVE-2022-4135 exploited? Yes: in CISA KEV since 28 Nov 2022

Gociux · Google Chromium GPU · data: CISA KEV, CVE record, FIRST EPSS

Yes. CVE-2022-4135, Google Chromium GPU Heap Buffer Overflow Vulnerability, is being exploited in the wild. CISA added it to its Known Exploited Vulnerabilities catalog on 28 Nov 2022, 3 days after it was published. It affects Google Chromium GPU. If you run it, CISA's required action is: Apply updates per vendor instructions.

What it is

Google Chromium GPU contains a heap buffer overflow vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

What to do

1. Check whether you run it. Look for Chromium GPU in your asset inventory, including appliances and cloud images. Stack check lists every exploited Google CVE at once.
2. Apply the fix. Apply updates per vendor instructions.
3. If you can't patch today, take the affected service off the internet or restrict who can reach it, and check its logs for signs of compromise since 25 Nov 2022.
4. Get told next time. Email alerts when CISA adds a CVE for Google.

References

• chromereleases.googleblog.com/2022/11/stable-channel-update-for-desktop_24.html
• nvd.nist.gov/vuln/detail/CVE-2022-4135

Sources: CISA KEV (exploitation, ransomware use, required action, due date), the CVE record (publication date, CVSS, CNA), NVD and FIRST EPSS (live score). More: all KEV additions in November 2022 · Google scorecard · act-now radar.