CVE-2022-4135
Google Chromium GPU Heap Buffer Overflow Vulnerability
Published Nov 24, 2022 · updated Jun 16, 2026 · google chrome
Google Chromium GPU contains a heap buffer overflow vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Timeline
Detection, updates, and resolution for this record.
Nov 24, 2022 · Catalog
Detected
Google Chromium GPU contains a heap buffer overflow vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Nov 28, 2022 · CISA KEV
Known exploited
Apply updates per vendor instructions.
Dec 19, 2022 · CISA KEV
Remediation due
Apply updates per vendor instructions.
Jun 16, 2026 · Catalog
Updated
Google Chromium GPU contains a heap buffer overflow vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Required action
Apply updates per vendor instructions.
CISA due date Dec 19, 2022
Affected
- cpe google/chromeversion unspecified
- cpe microsoft/edgeversion unspecified
- cpe microsoft/edge chromiumversion unspecified
- vendor Google Chromium GPUversion unspecified
Sources
- CISA KEVCVE-2022-4135
Google Chromium GPU contains a heap buffer overflow vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
cisa.gov - CVE.orgCVE-2022-4135
Official CVE identifier
cve.org - FIRST EPSSCVE-2022-4135
30-day exploitation probability 31.9%
first.org - NIST NVDCVE-2022-4135
Heap buffer overflow in GPU in Google Chrome prior to 107.0.5304.121 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
nvd.nist.gov