CVE-2022-2010

CriticalCVSS 9.3/10Last modified Jun 17, 2026

Description

Out of bounds read in compositing in Google Chrome prior to 102.0.5005.115 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.

Metrics

CVSS 3.1 9.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:H

Weakness enumeration

CWE-125

Affected software

No affected versions have been published.

Timeline

Published
Jul 28, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-201004.4In aee daemon, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosureCVE-2022-201015.5In aee daemon, there is a possible information disclosure due to a path traversal. This could lead to local information disclosure with no aCVE-2022-201024.4In aee daemon, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosureCVE-2022-201034.4In aee daemon, there is a possible information disclosure due to symbolic link following. This could lead to local information disclosure wiCVE-2022-201045.5In aee daemon, there is a possible information disclosure due to improper access control. This could lead to local information disclosure wiCVE-2022-201056.7In MM service, there is a possible out of bounds write due to a stack-based buffer overflow. This could lead to local escalation of privilegCVE-2022-201066.7In MM service, there is a possible out of bounds write due to a heap-based buffer overflow. This could lead to local escalation of privilegeCVE-2022-201074.4In subtitle service, there is a possible application crash due to an integer overflow. This could lead to local denial of service with SysteCVE-2022-201086.7In voice service, there is a possible out of bounds write due to a stack-based buffer overflow. This could lead to local escalation of priviCVE-2022-201097.8In ion, there is a possible use after free due to improper update of reference count. This could lead to local escalation of privilege with CVE-2022-20118.8Use after free in ANGLE in Google Chrome prior to 102.0.5005.115 allowed a remote attacker to potentially exploit heap corruption via a crafCVE-2022-201107.0In ion, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional exec
CVE-2022-2010: Critical severity, CVSS 9.3 | Vulnix