CVE-2022-1145
📋 TL;DR
This vulnerability allows attackers to exploit heap corruption through a use-after-free bug in Chrome's extension system. Attackers must convince users to install a malicious extension and then trigger specific user interactions while destroying profiles. All Chrome users with vulnerable versions are affected.
💻 Affected Systems
- Google Chrome
📦 What is this software?
Chrome by Google
Google Chrome is the world's most popular web browser, used by over 3 billion users globally across Windows, macOS, Linux, Android, and iOS platforms. As a Chromium-based browser developed by Google, Chrome dominates the browser market with approximately 65% market share, making it a critical compon...
Learn more about Chrome →⚠️ Risk & Real-World Impact
Worst Case
Full system compromise through arbitrary code execution, potentially leading to data theft, ransomware deployment, or complete system control.
Likely Case
Browser compromise allowing session hijacking, credential theft, and installation of persistent malware through malicious extensions.
If Mitigated
Limited impact with proper extension vetting and user education, potentially only browser crash or limited data exposure.
🎯 Exploit Status
Requires social engineering to install malicious extension plus specific user interaction sequences.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 100.0.4896.60 and later
Vendor Advisory: https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop_29.html
Restart Required: Yes
Instructions:
1. Open Chrome 2. Click menu → Help → About Google Chrome 3. Allow update to download and install 4. Click Relaunch to restart Chrome
🔧 Temporary Workarounds
Disable Extension Installation
allPrevent users from installing extensions to block the initial attack vector
chrome://settings/content/extensions → Toggle 'Allow extensions from other stores' to OFF
Enable Enhanced Protection
allEnable Chrome's enhanced security features for better protection
chrome://settings/security → Select 'Enhanced protection'
🧯 If You Can't Patch
- Implement strict extension whitelisting policies
- Deploy application control to block Chrome execution
🔍 How to Verify
Check if Vulnerable:
Check Chrome version in menu → Help → About Google ChromeCheck Version:
google-chrome --versionVerify Fix Applied:
Confirm version is 100.0.4896.60 or higher📡 Detection & Monitoring
Log Indicators:
- Chrome crash reports with extension-related errors
- Unexpected extension installation events
Network Indicators:
- Downloads from suspicious extension stores
- Unusual extension update traffic
SIEM Query:
source="chrome" AND (event="extension_install" OR event="crash") AND version<"100.0.4896.60"🔗 References
- https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop_29.html
- https://crbug.com/1304545
- https://security.gentoo.org/glsa/202208-25
- https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop_29.html
- https://crbug.com/1304545
- https://security.gentoo.org/glsa/202208-25
