CVE-2022-3658
Last modified
CVE-2022-3658 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. Use after free in Feedback service on Chrome OS in Google Chrome on Chrome OS prior to 107.0.5304.62 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via specific UI interaction. (Chromium security severity: Medium). EPSS estimates a 0.40% chance of exploitation in the next 30 days.
Description
Use after free in Feedback service on Chrome OS in Google Chrome on Chrome OS prior to 107.0.5304.62 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via specific UI interaction. (Chromium security severity: Medium)
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Chrome | < 107.0.5304.62 |
References
- https://chromereleases.googleblog.com/2022/10/stable-channel-update-for-desktop_25.htmlRelease Notes, Vendor Advisory
- https://crbug.com/1352817Exploit, Issue Tracking, Permissions Required, Vendor Advisory
- https://chromereleases.googleblog.com/2022/10/stable-channel-update-for-desktop_25.htmlRelease Notes, Vendor Advisory
- https://crbug.com/1352817Exploit, Issue Tracking, Permissions Required, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-3658?
How severe is CVE-2022-3658?
How do I fix CVE-2022-3658?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-36571Tenda AC9 V15.03.05.19 was discovered to contain a stack ove…7.2
- CVE-2022-36572Sinsiu Sinsiu Enterprise Website System v1.1.1.0 was discove…9.8
- CVE-2022-36573A cross-site scripting (XSS) vulnerability in Pagekit CMS v1…6.1
- CVE-2022-36577An issue was discovered in jizhicms v2.3.1. There is a CSRF …8.8
- CVE-2022-36578jizhicms v2.3.1 has SQL injection in the background.9.8
- CVE-2022-36579Wellcms 2.2.0 is vulnerable to Cross Site Request Forgery (C…8.8
- CVE-2022-36580An arbitrary file upload vulnerability in the component /adm…7.2
- CVE-2022-36581Online Ordering System v2.3.2 was discovered to contain a SQ…7.5
- CVE-2022-36582An arbitrary file upload vulnerability in the component /php…7.2
- CVE-2022-36583DedeCMS V5.7.97 was discovered to contain multiple cross-sit…6.1
- CVE-2022-36584In Tenda G3 US_G3V3.0br_V15.11.0.6(7663)_EN_TDE, the getsing…9.8
- CVE-2022-36585In Tenda G3 US_G3V3.0br_V15.11.0.6(7663)_EN_TDE, in httpd bi…9.8
Are you affected by CVE-2022-3658?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST