Vulnerability Spotlight: Use-after-free condition in Google Chrome WebGPU

Piotr Bania of Cisco Talos discovered this vulnerability. Blog by Jon Munshaw.

Cisco Talos recently discovered an exploitable use-after-free vulnerability in Google Chrome’s WebGPU standard.

Google Chrome is a cross-platform web browser — and Chromium is the open-source version of the browser that both Google and other software developers use as the basis to build their browsers, as well. This specific vulnerability exists in WebGPU, which is a JavaScript API for processing accelerated 3-D graphics and other functions in the browser.

TALOS-2022-1508 (CVE-2022-2399) occurs if the user opens a specially crafted web page in Chrome. That page could trigger a use-after-free condition in the application, which an attacker could then use to manipulate the browser in additional ways.

Cisco Talos worked with Google to ensure that this issue is resolved and an update is available for affected customers, all in adherence to Cisco’s vulnerability disclosure policy.

Users are encouraged to update these affected products as soon as possible: Google Chrome, version 102.0.4956.0 (64-bit) and 99.0.4844.82 (64-bit). Talos tested and confirmed these versions of Chrome could be exploited by this vulnerability.

The following Snort rules will detect exploitation attempts against this vulnerability: 59448 and 59449. Additional rules may be released in the future and current rules are subject to change, pending additional vulnerability information. For the most current rule information, please refer to your Firepower Management Center or Snort.org.