LiveActive security incident?Get immediate response
CVE Record

CVE-2022-3307: Use after free in media in Google Chrome prior to 106.0.5249.62 allowed a remote attacker to potentially ex...

Use after free in media in Google Chrome prior to 106.0.5249.62 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

HighCVSS 8.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

CVE-2022-3307 is a high-severity Google Chrome media handling flaw. A user who opens a crafted HTML page could expose Chrome to heap corruption, potentially affecting confidentiality, integrity, and availability. The supplied sources do not show active exploitation.

Executive priority

High priority for endpoint patch management. This is a browser remote attack surface with high potential impact, but current supplied evidence does not show active exploitation. Patch promptly through normal emergency browser update processes.

Technical view

The CVE describes a use-after-free condition in Chrome's media component before version 106.0.5249.62. Remote attack is possible over the network but requires user interaction. The CVSS 3.1 score is 8.8, with high impact across confidentiality, integrity, and availability.

Likely exposure

Organizations are primarily exposed where Google Chrome versions earlier than 106.0.5249.62 remain installed. The source bundle names Google Chrome only and does not establish exposure for other Chromium-based products.

Exploitation context

Exploitation would require convincing a user to load a crafted HTML page. The bundle does not include exploit code, public exploitation confirmation, or CISA KEV listing. Treat exploit status as unconfirmed from the supplied evidence.

Researcher notes

The public description is brief and the Chromium bug link may not provide complete technical detail. The bundle lists CWE-362 while the description says use-after-free, so validate classification against vendor/NVD data before deeper root-cause tracking.

Mitigation direction

  • Update Google Chrome to 106.0.5249.62 or later.
  • Verify browser auto-update is enabled and functioning.
  • Prioritize managed desktops, kiosks, and shared workstations.
  • Check Google guidance for any additional vendor instructions.
  • Remove or isolate unsupported Chrome installations.

Validation and detection

  • Inventory Chrome versions across managed endpoints.
  • Flag any Chrome installation older than 106.0.5249.62.
  • Confirm patched endpoints report the expected stable version or later.
  • Review browser management logs for update failures.
  • Document remaining exceptions with owner and remediation date.
Prepared
Confidence
high
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-362: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2022-3307 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
8.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
3Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
8.8CVSS 3.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H2.85.9Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

8.8High
CVSS 3.1 vector shape for CVE-2022-3307Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
GoogleChromeunspecifiedListed
Weakness

CWE details

CWE-362

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-362 · source CWE mapping

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs