EXPOSURES › CVE-2022-0609
CVE-2022-0609
HIGH ⌖ ON CISA KEV · EXPLOITEDA use-after-free vulnerability in Google Chromium's animation code allowed remote attackers to exploit heap corruption via crafted HTML pages.
This use-after-free flaw in Chromium's animation subsystem enabled remote code execution via heap corruption, affecting major browsers like Chrome and Edge. DIB organizations must ensure their browsers are patched against this actively exploited vulnerability to prevent ransomware or data breaches. The failure stems from unpatched, exploitable code in a widely deployed software supply chain.
Shame score — A known, actively exploited vulnerability in a foundational browser engine that could be weaponized for ransomware or data exfiltration, representing a severe supply-chain risk.
▸ RECOMMENDED ACTION Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
Google Chromium Animation contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
"Google Chromium Animation contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page."
"Google confirms that an exploit for the vulnerability is already being used in the wild"
"Google confirms that an exploit for the vulnerability is already being used in the wild"
| PRODUCT | STATUS |
|---|---|
| Google Services (Google Cloud Platform Products and underlying Infrastructure) Google |
Authorized |
| Google Workspace Google |
Authorized |