CVE-2022-0311 Task Manager in Chrome prior to 97.0.4692.99 had a heap buffer overflow that could be exploited via specific user interaction.

CVE-2022-0311 Task Manager in Chrome prior to 97.0.4692.99 had a heap buffer overflow that could be exploited via specific user interaction.

Google engineers demonstrated that Task Manager in Google Chrome prior to 97.0.4692.99 allowed a remote attacker who convinced a user to engage in specific user interaction to potentially exploit heap corruption via a crafted HTML page. Task Manager in Google Chrome prior to 97.0.4692.99, when entered into a specific user interaction mode, allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. A user interaction mode bypassed a Content Security Policy (CSP) block in Task Manager in Google Chrome prior to 97.0.4692.99, allowing a remote attacker to potentially perform heap manipulation via a crafted HTML page. An integer overflow in Task Manager in Google Chrome prior to 97.0.4692.99 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. A user interaction mode bypassed a Content Security Policy (CSP) block in Task Manager in Google Chrome prior to 97.0.4692.99, allowing a remote attacker to potentially perform heap manipulation via a crafted HTML page. An integer overflow in Task Manager in Google Chrome prior to 97.0.4692.99 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. A user interaction mode bypassed a Content Security Policy (CSP) block in Task Manager in Google Chrome prior to 97.0.4692.99, allowing a remote attacker to potentially perform heap manipulation via a crafted HTML page. A heap buffer overflow in Task Manager

task manager

Google engineers demonstrated that Task Manager in Google Chrome prior to 97.0.4692.99 allowed a remote attacker who convinced a user to engage in specific user interaction to potentially exploit heap corruption via a crafted HTML page. Task Manager in Google Chrome prior to 97.0.4692.99, when entered into a specific user interaction mode, allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. A user interaction mode bypassed a Content Security Policy (CSP) block in Task Manager in Google Chrome prior to 97.0.4692.99, allowing a remote attacker to potentially perform heap manipulation via a crafted HTML page. An integer overflow in Task Manager in Google Chrome prior to 97.0.4692.99 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. A user interaction mode bypassed a Content Security Policy (CSP) block in Task Manager in Google Chrome prior to 97.0.4692.99, allowing a remote attacker to potentially perform heap manipulation via a crafted HTML page.

Task Manager in Google Chrome prior to 97.0.4692.99

In Task Manager in Google Chrome prior to 97.0.4692.99, the page does not verify whether the Content Security Policy (CSP) is enabled before opening a WebView for interacting with content from an HTML page. The WebView allows a remote attacker to potentially exploit heap corruption via a crafted HTML page and perform heap manipulation via a crafted HTML page.

References

Subscribe to CVE.news
Don’t miss out on the latest issues. Sign up now to get access to the library of members-only issues.
jamie@example.com
Subscribe