CVE-2022-3445 is a use-after-free vulnerability found in Skia, Google's open-source 2D graphics library used by Chrome. Before Chrome version 106..5249.119, a remote attacker could potentially corrupt the heap memory with a specially designed web page. This flaw was rated High Severity by the Chromium team, and rightly so—it could open the door to arbitrary code execution on a user’s machine.

In this article, we will break down what happened, look at how exploitation can work, and see the code involved. All the explanations will be straightforward and easy to understand.

What is a Use-After-Free?

A "use-after-free" bug happens when a program keeps using memory after it has been freed (released). If an attacker can control the data at that memory address, this can be used to crash the program, corrupt memory, or even run malicious code.

Skia and Its Role

Skia is the graphics engine behind page rendering in Chrome and many Google products. When you visit a website with custom fonts, colors, canvases, or SVGs, Skia is often quietly doing the heavy lifting behind the scenes.

Discovery and Reporting

Google's security team identified the bug (CVE-2022-3445), and detailed it in the Chrome releases and their bug tracker:

- Chromium Release Notes (106..5249.119)
- NVD Entry for CVE-2022-3445
- Chromium Issue Tracker (#1369874)

How the Vulnerability Happens

When Chrome is rendering certain kinds of HTML content, it might release (free) some objects in Skia, but then try to use them again. If a web page manipulates graphics data in a specific pattern (for example, by combining certain SVG elements or using JavaScript on a <canvas>), it could trigger the use-after-free.

Let’s look at a simplified code snippet to understand the concept

// Simplified C++ example

void SkiaRenderFunction(SkiaObject *obj) {
    free(obj);               // Object memory is freed here
    ...                      // Some operations
    obj->doSomething();      // Use-after-free: using memory that's already freed!
}

In real Skia code, this involves complex objects, multiple references, and garbage collection systems, making it difficult to spot.

Example Exploit (Simplified with HTML & JS)

<script>
function triggerUAF() {
    for (let i = ; i < 10000; i++) {
        let canvas = document.createElement('canvas');
        let ctx = canvas.getContext('2d');

        // Force Skia to allocate and free memory in a pattern
        ctx.arc(100, 75, 50, , 2 * Math.PI);
        document.body.appendChild(canvas);
        document.body.removeChild(canvas);
    }
    // Heap spray / further exploit steps would go here
}
window.onload = triggerUAF;
</script>

This code won’t actually exploit CVE-2022-3445, but it shows the basic idea: create and destroy graphics objects rapidly to manipulate memory.

What Was the Fix?

Google developers quickly patched this bug in Skia by making sure Chrome does not use objects after they’re freed. The patch ensures that destructors clear references and proper memory management is enforced.

Relevant Patch:  
Chromium Commit (might require login for full details)

Be Cautious with Strange Websites: Exploits tend to come from suspicious sites.

4. Use OS Security Features: Tools like Windows Defender, macOS Gatekeeper, or Linux sandboxing help shield memory attacks.

Conclusion

CVE-2022-3445 is a high-severity bug in Skia that affects Chrome users by allowing remote attackers, via crafted websites, to corrupt memory and potentially run code. Google has patched this issue in recent Chrome versions, so updating is crucial.

References

- Chromium Release Note (Version 106..5249.119)
- CVE-2022-3445 Summary in NVD
- Skia Graphics Engine
- Chromium Issue #1369874  
- Skia Source Code


If you want more in-depth technical details, follow the Chromium security blog and watch out for further bug analyses and hands-on exploit writeups by the security community.

Timeline

Published on: 11/09/2022 19:15:00 UTC
Last modified on: 11/10/2022 15:26:00 UTC