CVE-2022-3304 is a high-severity use-after-free vulnerability in the CSS component of Google Chrome prior to version 106.0.5249.62. This flaw allows a remote attacker to potentially exploit heap corruption and achieve high impact on confidentiality, integrity, and availability through a crafted HTML page, requiring user interaction. While there is no known public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered some community discussion and media coverage, including a mention in Microsoft's October 2022 Patch Tuesday, although it is not currently listed on CISA's KEV catalog.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 106.0.5249.62CPE match | cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.1 Security Researcher mentions.