{"id":"CVE-2022-4135","kind":"vulnerability","aliases":["CVE-2022-4135"],"related":[],"title":"Heap buffer overflow in GPU in Google Chrome prior to 107.0.5304.121 allowed a remote attacker who had compromised…","description":"Google Chromium GPU contains a heap buffer overflow vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.\n\nCISA required action: Apply updates per vendor instructions.","summary":"A heap buffer overflow in the Chromium GPU process lets an attacker who already controls the renderer escape the browser sandbox via a crafted HTML page. CISA lists it as actively exploited.","severity":"critical","cvss":9.6,"epss":null,"exploited":true,"exploited_at":"2022-11-28T00:00:00+00:00","products":[{"name":"Google Chromium GPU","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"google chrome","fixed":["107.0.5304.121"],"affected":"< 107.0.5304.121","ecosystem":"vendor"},{"name":"microsoft edge","fixed":["107.0.1418.62"],"affected":"< 107.0.1418.62","ecosystem":"vendor"},{"name":"microsoft edge chromium","fixed":["107.0.5304.150"],"affected":"< 107.0.5304.150","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["browsers","chrome","chromium","edge","exploited","opera","other"],"not_affected_if":["fully-patched-browser"],"how_to_check":"Open the browser's version page (chrome://version or edge://version) and compare against the fixed Chromium release in the vendor advisory; unknown exact fixed version in sources.","fix":"Update Google Chrome, Microsoft Edge, Opera or other Chromium-based browsers to the vendor's patched release; CISA says apply updates per vendor instructions.","status":"open","published_at":"2022-11-25T01:15:09+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:08:55+00:00","updated_at":"2026-10-23T22:29:04+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-10-23T21:08:55Z","model":"claude-haiku-5-5","output":{"fix":"Update Google Chrome, Microsoft Edge, Opera or other Chromium-based browsers to the vendor's patched release; CISA says apply updates per vendor instructions.","reach":"internet","impact":"high","summary":"A heap buffer overflow in the Chromium GPU process lets an attacker who already controls the renderer escape the browser sandbox via a crafted HTML page. CISA lists it as actively exploited.","category":"other","who_cares":["chrome","edge","opera","chromium","browsers"],"confidence":0.8,"needs_auth":"no","worst_case":"Attacker escapes renderer sandbox and runs code outside the browser sandbox","analyst_note":"Confirm the fixed Chromium version and vendor advisory URLs for Chrome, Edge and Opera; sources do not list affected or fixed versions.","how_to_check":"Open the browser's version page (chrome://version or edge://version) and compare against the fixed Chromium release in the vendor advisory; unknown exact fixed version in sources.","needs_analyst":true,"not_affected_if":["fully-patched-browser"],"user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000495,"input_tokens":2867,"output_tokens":417,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2022':20A,23A '-4135':21A,24A '107.0.5304.121':11A 'action':127C 'activ':71B 'affect':107C 'allow':12A,83C 'alreadi':54B 'appli':128C 'attack':15A,52B,86C 'browser':35B,60B,110C 'buffer':2A,43B,79C 'chrome':8A,29A,36B,120C 'chromium':26A,34A,37B,47B,74C,113C 'cisa':67B,125C 'compromis':18A,89C 'contain':76C 'control':55B 'could':106C 'craft':64B,101C 'cve':19A,22A 'edg':38B,122C 'edge':31A,33A 'escap':58B,98C 'exploit':39B,72B 'googl':7A,73C,119C 'google':25A,28A 'gpu':5A,27A,48B,75C 'heap':1A,42B,78C 'html':65B,102C 'includ':114C 'instruct':132C 'let':50B 'limit':117C 'list':68B 'microsoft':30A,32A,121C 'multipl':108C 'opera':40B,124C 'overflow':3A,44B,80C 'page':66B,103C 'per':130C 'perform':95C 'potenti':94C 'prior':9A 'process':49B,92C 'remot':14A,85C 'render':57B,91C 'requir':126C 'sandbox':61B,97C 'updat':129C 'util':112C 'vendor':131C 'via':62B,99C 'vulner':81C,105C 'web':109C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2022-11-25T01:15:09+00:00","kev":{"dateAdded":"2022-11-28","dueDate":"2022-12-19","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2022-4135","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-4135","severity":null,"published_at":"2022-11-28T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T20:35:35+00:00","note":null},{"source":"nvd","external_id":"CVE-2022-4135","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-4135","severity":null,"published_at":"2022-11-25T01:15:09+00:00","modified_at":"2026-06-17T05:20:03+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}