CVE-2022-0609

HIGH KEV RANSOMWARE

Google Chrome <98.0.4758.102 - Use After Free

Title source: llm

Exploitation Summary

CVE-2022-0609 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added February 15, 2022, with confirmed use in ransomware campaigns.

Description

Use after free in Animation in Google Chrome prior to 98.0.4758.102 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

References (3)

Core 3

Core References

Release Notes, Vendor Advisory x_refsource_misc

https://chromereleases.googleblog.com/2022/02/stable-channel-update-for-desktop_14.html

Issue Tracking, Vendor Advisory x_refsource_misc

https://crbug.com/1296150

US Government Resource

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-0609

Scores

CVSS v3 8.8

EPSS 0.4900

EPSS Percentile 97.8%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation active

Automatable no

Technical Impact total

Details

CISA KEV 2022-02-15

VulnCheck KEV 2022-02-10

InTheWild.io 2022-02-10

ENISA EUVD EUVD-2022-1213

Ransomware Use Confirmed

CWE

CWE-416

Status published

Products (10)

google/chrome < 98.0.4758.102

nuget/CefSharp.Common 0 - 98.1.210NuGet

nuget/CefSharp.Common.NETCore 0 - 98.1.210NuGet

nuget/CefSharp.OffScreen 0 - 98.1.210NuGet

nuget/CefSharp.OffScreen.NETCore 0 - 98.1.210NuGet

nuget/CefSharp.WinForms 0 - 98.1.210NuGet

nuget/CefSharp.WinForms.NETCore 0 - 98.1.210NuGet

nuget/CefSharp.Wpf 0 - 98.1.210NuGet

nuget/CefSharp.Wpf.HwndHost 0 - 98.1.210NuGet

nuget/CefSharp.Wpf.NETCore 0 - 98.1.210NuGet

Published Apr 05, 2022

KEV Added Feb 15, 2022

Tracked Since Feb 18, 2026