CVE-2022-0300
📋 TL;DR
This is a use-after-free vulnerability in Google Chrome's Text Input Method Editor on Android that allows remote attackers to potentially exploit heap corruption. Attackers can trigger this by convincing users to interact with a crafted HTML page. Only Android users running Chrome versions before 97.0.4692.99 are affected.
💻 Affected Systems
- Google Chrome for Android
📦 What is this software?
Chrome by Google
Google Chrome is the world's most popular web browser, used by over 3 billion users globally across Windows, macOS, Linux, Android, and iOS platforms. As a Chromium-based browser developed by Google, Chrome dominates the browser market with approximately 65% market share, making it a critical compon...
Learn more about Chrome →⚠️ Risk & Real-World Impact
Worst Case
Full device compromise including arbitrary code execution, data theft, and persistence on the Android device.
Likely Case
Browser crash leading to denial of service, potential information disclosure, or limited code execution within browser sandbox.
If Mitigated
No impact if Chrome is updated to patched version or if exploit attempts are blocked by security controls.
🎯 Exploit Status
Requires user interaction with malicious content but no authentication needed. No public exploit code has been disclosed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 97.0.4692.99 and later
Vendor Advisory: https://chromereleases.googleblog.com/2022/01/stable-channel-update-for-desktop_19.html
Restart Required: Yes
Instructions:
1. Open Google Play Store on Android device. 2. Search for 'Chrome'. 3. If update is available, tap 'Update'. 4. Restart Chrome after update completes.
🔧 Temporary Workarounds
Disable JavaScript
androidPrevents execution of malicious JavaScript that could trigger the vulnerability
chrome://settings/content/javascript (disable)
Use alternative browser
androidTemporarily switch to a different browser until Chrome is updated
🧯 If You Can't Patch
- Disable Chrome and use alternative browser temporarily
- Implement network filtering to block known malicious sites
🔍 How to Verify
Check if Vulnerable:
Open Chrome on Android, go to Settings > About Chrome, check if version is below 97.0.4692.99Check Version:
chrome://version/ in Chrome address barVerify Fix Applied:
Confirm Chrome version is 97.0.4692.99 or higher in Settings > About Chrome📡 Detection & Monitoring
Log Indicators:
- Chrome crash reports
- Unexpected process termination logs
Network Indicators:
- Requests to suspicious domains with crafted HTML content
SIEM Query:
source="chrome_crash_reports" AND version<"97.0.4692.99"