Vulnerability record · CVE-2022-3038 · published 26 September 2022
CVE-2022-3038: Google Chrome Network Service use-after-free via crafted HTML page
Google · Chrome
Chrome's Network Service contains a use-after-free (CWE-416) that a remote attacker can trigger with a crafted HTML page, leading to heap corruption. It affects Chrome before 105.0.5195.52 and was serious enough to be added to CISA's Known Exploited Vulnerabilities catalog.
Description
Use after free in Network Service in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Automated analysis
high priorityIt is in CISA KEV with a high CVSS (8.8) and high EPSS percentile, so exploitation is expected and patching is urgent.
What it is
Chrome's Network Service contains a use-after-free (CWE-416) that a remote attacker can trigger with a crafted HTML page, leading to heap corruption. It affects Chrome before 105.0.5195.52 and was serious enough to be added to CISA's Known Exploited Vulnerabilities catalog.
Impact
Successful exploitation can corrupt the heap and potentially allow arbitrary code execution in the browser process context. The CVSS vector rates confidentiality, integrity and availability impact as high.
Attack surface
Reached over the network by getting a victim to load a crafted HTML page; the vector requires user interaction (UI:R) but no authentication or privileges (PR:N).
Exploitation
CISA added it to KEV on 2023-03-30 with a 2023-04-20 remediation due date, and a reference is tagged Exploit, indicating known exploitation; EPSS 30-day probability is 0.247 (97.8th percentile). No ransomware campaign use is documented.
What to do
- Update Chrome to 105.0.5195.52 or later, and apply the corresponding Fedora and Gentoo package updates.
- Enforce automatic browser updates and verify deployed versions across endpoints.
- Restrict or isolate browsing of untrusted web content where feasible.
- Track KEV remediation deadlines and confirm closure by the due date.
Detection
- Monitor for Chrome renderer or network service crashes consistent with heap corruption.
- Hunt for exploit-related artifacts or unusual child processes spawned by Chrome.
- Review proxy and DNS logs for delivery of known exploit pages or hosts.
- Alert on endpoints running Chrome versions below 105.0.5195.52.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2022-3038 to the Known Exploited Vulnerabilities catalog on 30 March 2023 as "Google Chromium Network Service Use-After-Free Vulnerability". Required action: Apply updates per vendor instructions. Federal deadline 20 April 2023.
Affected products
2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2022-3038 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2022-3038), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
