Vulnerability record · CVE-2022-0609 · published 5 April 2022
CVE-2022-0609: Google Chrome Animation use-after-free enables heap corruption
Google · Chrome
Google Chrome before 98.0.4758.102 contains a use-after-free flaw in the Animation component. A crafted HTML page can trigger the bug and corrupt heap memory, and the flaw was exploited in the wild before the fix shipped.
Description
Use after free in Animation in Google Chrome prior to 98.0.4758.102 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Automated analysis
high priorityKnown exploited in the wild per CISA KEV with high EPSS and high CVSS impact, though exploitation requires a user to open a crafted page.
What it is
Google Chrome before 98.0.4758.102 contains a use-after-free flaw in the Animation component. A crafted HTML page can trigger the bug and corrupt heap memory, and the flaw was exploited in the wild before the fix shipped.
Impact
A remote attacker can corrupt heap memory in the browser process, which in practice can lead to code execution in the renderer or sandbox escape depending on the exploitation path. The CVSS vector rates confidentiality, integrity and availability impact as high.
Attack surface
Reached over the network by visiting a crafted HTML page; no authentication is required, but the victim must open the page (UI:R). The attack is delivered through normal web browsing.
Exploitation
Listed in CISA KEV with a 2022-02-15 addition and a 2022-03-01 remediation due date, indicating known exploitation. EPSS 30-day probability is 0.22933 (97.63 percentile), and no ransomware campaign use is documented.
What to do
- Update Chrome to 98.0.4758.102 or later, and verify the version on all managed endpoints.
- Apply the vendor stable channel update referenced in the Chrome release notes.
- Enforce automatic browser updates and restart browsers so pending updates take effect.
- Track KEV remediation deadlines and confirm closure for internet-facing and user browsing systems.
Detection
- Alert on Chrome versions below 98.0.4758.102 across the fleet.
- Monitor for browser crashes or renderer process terminations consistent with heap corruption.
- Review web proxy or DNS logs for known exploit-hosting domains tied to Chrome zero-day campaigns from early 2022.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2022-0609 to the Known Exploited Vulnerabilities catalog on 15 February 2022 as "Google Chromium Animation Use-After-Free Vulnerability". Required action: Apply updates per vendor instructions. Federal deadline 1 March 2022.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://chromereleases.googleblog.com/2022/02/stable-channel-update-for-desktop_14.html | Release NotesVendor Advisory |
| https://crbug.com/1296150 | Issue TrackingVendor Advisory |
| https://chromereleases.googleblog.com/2022/02/stable-channel-update-for-desktop_14.html | Release NotesVendor Advisory |
| https://crbug.com/1296150 | Issue TrackingVendor Advisory |
| https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-0609 | US Government Resource |
Track CVE-2022-0609 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2022-0609), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
