CVE-2022-4135: Google Chrome GPU heap buffer overflow enables sandbox escape

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityCVSS 9.6, active inclusion in CISA KEV, and a high EPSS percentile make this a top remediation priority despite the renderer-compromise precondition.

What it is

Chrome's GPU component contains a heap buffer overflow (CWE-787) fixed in version 107.0.5304.121. An attacker who already controls the renderer process can use a crafted HTML page to break out of the browser sandbox. Because the sandbox is the main containment boundary, a successful escape exposes the underlying operating system.

Impact

An attacker with renderer code execution gains the ability to escape the Chrome sandbox and run code at the browser's privilege level on the host. This turns a contained renderer compromise into a full host compromise.

Attack surface

Reached over the network via a crafted HTML page, requiring user interaction (UI:R) to load it. No authentication or privileges are needed, but the attacker must first have compromised the renderer process, so this is a second-stage exploit rather than a standalone remote entry point.

Exploitation

Listed in CISA KEV with a 2022-11-28 addition and 2022-12-19 remediation due date, and a reference is tagged Exploit. EPSS 30-day probability is 0.31864 (98.2nd percentile), indicating high likelihood of attempted exploitation.

What to do

• Update Chrome to 107.0.5304.121 or later, and apply the corresponding Microsoft Edge/Chromium updates.
• Track the CISA KEV due date of 2022-12-19 and confirm all endpoints are patched.
• Enforce automatic browser updates and verify version compliance across managed fleets.
• Restrict or isolate high-risk browsing and block untrusted HTML content where feasible.
• Monitor for follow-on host activity after any suspected renderer compromise.

Detection

• Alert on Chrome/Edge versions below 107.0.5304.121 in asset inventory.
• Hunt for browser processes spawning unexpected child processes or making anomalous outbound connections.
• Review crash reports referencing the GPU process or crbug.com/1392715 for signs of exploitation attempts.
• Correlate endpoint telemetry for sandbox-escape behavior such as unusual memory writes or privilege changes by browser processes.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.