CVE-2022-3449
Use after free in Safe Browsing in Google Chrome prior to 106.0.5249.119 allowed an attacker who...
Use after free in Safe Browsing in Google Chrome prior to 106.0.5249.119 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension. (Chromium security severity: High)
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Use after free in Safe Browsing in Google Chrome prior to 106.0.5249.119 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension. (Chromium security severity: High)
- Record
CVE-2022-3449- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-416
- Updated
- 2026-11-02
CVE List
Use after free in Safe Browsing in Google Chrome prior to 106.0.5249.119 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension. (Chromium security severity: High)
- Record
CVE-2022-3449- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-416
- Updated
- 2026-11-02
EUVDEUVD-2022-42823
Use after free in Safe Browsing in Google Chrome prior to 106.0.5249.119 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension. (Chromium security severity: High)
- Record
EUVD-2022-42823- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-9692-35cp-x87f
Use after free in Safe Browsing in Google Chrome prior to 106.0.5249.119 allowed an attacker who...
Use after free in Safe Browsing in Google Chrome prior to 106.0.5249.119 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension. (Chromium security severity: High)
- Record
GHSA-9692-35cp-x87f- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-416
- Updated
- 2026-11-02
OSV
Use after free in Safe Browsing in Google Chrome prior to 106.0.5249.119 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension. (Chromium security severity: High)
- Record
CVE-2022-3449- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2022-3449
Use after free in Safe Browsing in Google Chrome prior to 106.0.5249.119 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension. (Chromium security severity: High)
- Record
DEBIAN-CVE-2022-3449- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
Show 9 moreShow less
OSVUBUNTU-CVE-2022-3449
Use after free in Safe Browsing in Google Chrome prior to 106.0.5249.119 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension. (Chromium security severity: High)
- Record
UBUNTU-CVE-2022-3449- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2022-0376 No score
Updated chromium-browser-stable packages fix security vulnerability
The chromium-browser-stable package has been updated to the new 106 branch with the 106.0.5249.119 version, fixing many bugs and 6 vulnerabilities. Some of the security fixes are:
High CVE-2022-3445: Use after free in Skia. Reported by Nan Wang (@eternalsakura13) and Yong Liu of 360 Vulnerability Research Institute on 2022-09-16 High CVE-2022-3446: Heap buffer overflow in WebSQL. Reported by Kaijie Xu (@kaijieguigui) on 2022-09-26 High CVE-2022-3447: Inappropriate implementation in Custom Tabs. Reported by Narendra Bhati of Suma Soft Pvt. Ltd. Pune (India) on 2022-09-22 High CVE-2022-3448: Use after free in Permissions API. Reported by raven at KunLun lab on 2022-09-13 High CVE-2022-3449: Use after free in Safe Browsing. Reported by asnine on 2022-09-17 High CVE-2022-3450: Use after free in Peer Connection. Reported by Anonymous on 2022-09-30
- Record
MGASA-2022-0376- Updated
- 2026-11-02
OSVopenSUSE-SU-2022:10146-1 No score
Security update for chromium
This update for chromium fixes the following issues:
Chromium 106.0.5249.119 (boo#1204223):
- CVE-2022-3445: Use after free in Skia
- CVE-2022-3446: Heap buffer overflow in WebSQL
- CVE-2022-3447: Inappropriate implementation in Custom Tabs
- CVE-2022-3448: Use after free in Permissions API
- CVE-2022-3449: Use after free in Safe Browsing
- CVE-2022-3450: Use after free in Peer Connection
- Record
openSUSE-SU-2022:10146-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2022:10151-1 No score
Security update for chromium
This update for chromium fixes the following issues:
Chromium 106.0.5249.119 (boo#1204223):
- CVE-2022-3445: Use after free in Skia
- CVE-2022-3446: Heap buffer overflow in WebSQL
- CVE-2022-3447: Inappropriate implementation in Custom Tabs
- CVE-2022-3448: Use after free in Permissions API
- CVE-2022-3449: Use after free in Safe Browsing
- CVE-2022-3450: Use after free in Peer Connection
- Record
openSUSE-SU-2022:10151-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2022:10181-1 No score
Security update for opera
This update for opera fixes the following issues:
Update to 92.0.4561.21
- CHR-9037 Update chromium on desktop-stable-106-4561 to 106.0.5249.119
- DNA-102295 Missing GX.games section in settings
- DNA-102308 Presubmit errors
- DNA-102329 [Consent flow] clicking on 'Customize settings' doesn't resize the popup
- DNA-102340 Sidebar control panel doesn't hide
- DNA-102348 Replace old Dify url with a new one
- DNA-102430 Translations for O92
- DNA-102534 Allow staging RH Agent extension to use VPN Pro API
- DNA-102548 Rich hints extension crashes on Linux
- DNA-102551 Promote O92 to stable
- Complete Opera 92.0 changelog at: https://blogs.opera.com/desktop/changelog-for-92/
- The update to chromium 106.0.5249.119 fixes following issues:
CVE-2022-3445, CVE-2022-3446, CVE-2022-3447, CVE-2022-3448, CVE-2022-3449, CVE-2022-3450
Update to 91.0.4516.77
- DNA-101988 Implement dark mode for consent flow popups
- DNA-102348 Replace old Dify url with a new one
Update to 91.0.4516.65
- DNA-101240 Save “remind in 3 days” setting
- DNA-101622 Add a way to check if browser is connected to webenv
- DNA-101838 Unfiltered dropdown disabled by default on stable
- DNA-101990 Boost sites into top sites
- DNA-101998 flag tiktok-panel doesn’t work
- DNA-102075 Crash at extensions::ExtensionApiFrameIdMap:: OnRenderFrameDeleted(content::RenderFrameHost*)
- Record
openSUSE-SU-2022:10181-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2022:10182-1 No score
Security update for opera
This update for opera fixes the following issues:
Update to 92.0.4561.21
- CHR-9037 Update chromium on desktop-stable-106-4561 to 106.0.5249.119
- DNA-102295 Missing GX.games section in settings
- DNA-102308 Presubmit errors
- DNA-102329 [Consent flow] clicking on 'Customize settings' doesn't resize the popup
- DNA-102340 Sidebar control panel doesn't hide
- DNA-102348 Replace old Dify url with a new one
- DNA-102430 Translations for O92
- DNA-102534 Allow staging RH Agent extension to use VPN Pro API
- DNA-102548 Rich hints extension crashes on Linux
- DNA-102551 Promote O92 to stable
- Complete Opera 92.0 changelog at: https://blogs.opera.com/desktop/changelog-for-92/
- The update to chromium 106.0.5249.119 fixes following issues:
CVE-2022-3445, CVE-2022-3446, CVE-2022-3447, CVE-2022-3448, CVE-2022-3449, CVE-2022-3450
Update to 91.0.4516.77
- DNA-101988 Implement dark mode for consent flow popups
- DNA-102348 Replace old Dify url with a new one
Update to 91.0.4516.65
- DNA-101240 Save “remind in 3 days” setting
- DNA-101622 Add a way to check if browser is connected to webenv
- DNA-101838 Unfiltered dropdown disabled by default on stable
- DNA-101990 Boost sites into top sites
- DNA-101998 flag tiktok-panel doesn’t work
- DNA-102075 Crash at extensions::ExtensionApiFrameIdMap:: OnRenderFrameDeleted(content::RenderFrameHost*)
- Record
openSUSE-SU-2022:10182-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2023:0115-1 No score
Security update for opera
This update for opera fixes the following issues:
-
Update to 99.0.4788.13
- CHR-9290 Update Chromium on desktop-stable-113-4788 to 113.0.5672.127
- DNA-107317 __delayLoadHelper2 crash in crashreporter
-
The update to chromium 113.0.5672.127 fixes following issues: CVE-2023-2721, CVE-2023-2722, CVE-2023-2723, CVE-2023-2724, CVE-2023-2725, CVE-2023-2726
-
Update to 99.0.4788.9
- CHR-9283 Update Chromium on desktop-stable-113-4788 to 113.0.5672.93
- DNA-107638 Translations for O99
- DNA-107678 Crash Report [@ BrowserContextKeyedServiceFactory:: BrowserContextKeyedServiceFactory(char const*, BrowserContextDependencyManager*) ]
- DNA-107795 Fix wrong german translation of 'Close All Duplicate Tabs'
- DNA-107800 Fonts on section#folder and AddSitePanel not readable when animated wallpaper chosen
- DNA-107840 Promote O99 to stable
-
Update to 98.0.4759.39
- DNA-102363 ChromeFileSystemAccessPermissionContextTest. ConfirmSensitiveEntryAccess_DangerousFile fails
- DNA-105534 [Add to Opera] Incorrect scroll on modal when browser window size is too small
- DNA-106649 Opening new tab when pinned tab is active gives 2 active tabs
- DNA-107226 Speed Dial freezes and empty space remains after Continue booking tile dragging
- DNA-107435 Building archive_source_release target fails
- DNA-107441 [Start page] Right mouse click on tile in continue on section opens target site in current tab
- DNA-107508 Crash at permissions::PermissionRecoverySuccessRate Tracker::TrackUsage(ContentSettingsType)
- DNA-107528 Handle real-time SD impression reporting
- DNA-107546 Context menus broken with one workspace
- DNA-107548 Paste from Context Menu doesn’t work for Search on StartPage
- DNA-107560 Optimize real-time SD impression reporting
- Record
openSUSE-SU-2023:0115-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:12404-1 No score
chromedriver-106.0.5249.119-1.1 on GA media
These are all security issues fixed in the chromedriver-106.0.5249.119-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:12404-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:12948-1 No score
ungoogled-chromium-113.0.5672.92-1.1 on GA media
These are all security issues fixed in the ungoogled-chromium-113.0.5672.92-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:12948-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
chromiumDebian:12 |
before 106.0.5249.119-1 | 106.0.5249.119-1 |
chromiumDebian:13 |
before 106.0.5249.119-1 | 106.0.5249.119-1 |
chromiumDebian:14 |
before 106.0.5249.119-1 | 106.0.5249.119-1 |
chromiumDebian:11 From an advisory covering 6 CVEs |
before 106.0.5249.119-1~deb11u1, plus listed versions 100.0.4896.127-1100.0.4896.127-1~deb11u1100.0.4896.60-1100.0.4896.60-1~deb11u1100.0.4896.75-1 Show 45 moreShow less100.0.4896.75-1~deb11u1100.0.4896.88-1100.0.4896.88-1~deb11u1101.0.4951.41-1101.0.4951.41-1~deb11u1101.0.4951.41-2101.0.4951.54-1101.0.4951.64-1101.0.4951.64-1~deb11u1102.0.5005.115-1102.0.5005.115-1~deb11u1102.0.5005.61-1102.0.5005.61-1~deb11u1103.0.5060.114-1103.0.5060.114-1~deb11u1103.0.5060.134-1103.0.5060.134-1~deb11u1103.0.5060.53-1103.0.5060.53-1~deb11u1104.0.5112.101-1104.0.5112.101-1~deb11u1104.0.5112.79-1104.0.5112.79-1~deb11u1105.0.5195.102-1105.0.5195.102-1~deb11u1105.0.5195.125-1105.0.5195.125-1~deb11u1105.0.5195.52-1105.0.5195.52-1~deb11u1106.0.5249.103-1106.0.5249.103-2106.0.5249.61-1106.0.5249.61-1~deb11u1106.0.5249.91-1106.0.5249.91-1~deb11u190.0.4430.212-193.0.4577.82-197.0.4692.71-0.197.0.4692.71-0.1~deb11u197.0.4692.99-197.0.4692.99-1~deb11u197.0.4692.99-1~deb11u298.0.4758.102-198.0.4758.102-1~deb11u198.0.4758.80-1 |
106.0.5249.119-1~deb11u1 |
chromium-browser-stableMageia:8 From an advisory covering 6 CVEs |
before 106.0.5249.119-1.mga8 | 106.0.5249.119-1.mga8 |
chromium-browserUbuntu:18.04:LTS |
before 107.0.5304.87-0ubuntu11.18.04.1, plus listed versions 61.0.3163.100-0ubuntu1.137862.0.3202.62-0ubuntu0.17.10.138062.0.3202.89-0ubuntu1.138662.0.3202.94-0ubuntu1.138863.0.3239.84-0ubuntu1 Show 45 moreShow less63.0.3239.108-0ubuntu164.0.3282.119-0ubuntu164.0.3282.140-0ubuntu164.0.3282.167-0ubuntu165.0.3325.146-0ubuntu165.0.3325.181-0ubuntu166.0.3359.139-0ubuntu0.18.04.366.0.3359.181-0ubuntu0.18.04.167.0.3396.99-0ubuntu0.18.04.168.0.3440.75-0ubuntu0.18.04.168.0.3440.106-0ubuntu0.18.04.169.0.3497.81-0ubuntu0.18.04.170.0.3538.67-0ubuntu0.18.04.170.0.3538.77-0ubuntu0.18.04.170.0.3538.110-0ubuntu0.18.04.171.0.3578.80-0ubuntu0.18.04.171.0.3578.98-0ubuntu0.18.04.172.0.3626.119-0ubuntu0.18.04.172.0.3626.121-0ubuntu0.18.04.173.0.3683.75-0ubuntu0.18.04.173.0.3683.86-0ubuntu0.18.04.174.0.3729.169-0ubuntu0.18.04.175.0.3770.90-0ubuntu0.18.04.175.0.3770.142-0ubuntu0.18.04.176.0.3809.87-0ubuntu0.18.04.176.0.3809.100-0ubuntu0.18.04.177.0.3865.90-0ubuntu0.18.04.178.0.3904.70-0ubuntu0.18.04.278.0.3904.97-0ubuntu0.18.04.178.0.3904.108-0ubuntu0.18.04.179.0.3945.79-0ubuntu0.18.04.179.0.3945.130-0ubuntu0.18.04.180.0.3987.87-0ubuntu0.18.04.180.0.3987.149-0ubuntu0.18.04.180.0.3987.163-0ubuntu0.18.04.181.0.4044.122-0ubuntu0.18.04.181.0.4044.138-0ubuntu0.18.04.183.0.4103.61-0ubuntu0.18.04.184.0.4147.105-0ubuntu0.18.04.185.0.4183.83-0ubuntu0.18.04.285.0.4183.121-0ubuntu0.18.04.186.0.4240.75-0ubuntu0.18.04.186.0.4240.198-0ubuntu0.18.04.187.0.4280.66-0ubuntu0.18.04.189.0.4389.82-0ubuntu0.18.04.1 |
107.0.5304.87-0ubuntu11.18.04.1 |
chromiumSUSE:Package Hub 15 SP4 From an advisory covering 6 CVEs |
before 106.0.5249.119-bp154.2.35.1 | 106.0.5249.119-bp154.2.35.1 |
chromiumopenSUSE:Leap 15.4 From an advisory covering 6 CVEs |
before 106.0.5249.119-bp154.2.35.1 | 106.0.5249.119-bp154.2.35.1 |
chromiumSUSE:Package Hub 15 SP3 From an advisory covering 6 CVEs |
before 106.0.5249.119-bp153.2.128.1 | 106.0.5249.119-bp153.2.128.1 |
chromiumopenSUSE:Leap 15.3 From an advisory covering 6 CVEs |
before 106.0.5249.119-bp153.2.128.1 | 106.0.5249.119-bp153.2.128.1 |
Show 5 moreShow less
| Package | Affected | Fixed |
|---|---|---|
operaopenSUSE:Leap 15.3 NonFree From an advisory covering 6 CVEs |
before 92.0.4561.21-lp153.2.66.1 | 92.0.4561.21-lp153.2.66.1 |
operaopenSUSE:Leap 15.4 NonFree From an advisory covering 6 CVEs |
before 92.0.4561.21-lp154.2.26.1 | 92.0.4561.21-lp154.2.26.1 |
operaopenSUSE:Leap 15.5 NonFree From an advisory covering 89 CVEs |
before 99.0.4788.13-lp155.3.6.1 | 99.0.4788.13-lp155.3.6.1 |
chromiumopenSUSE:Tumbleweed From an advisory covering 6 CVEs |
before 106.0.5249.119-1.1 | 106.0.5249.119-1.1 |
chromiumopenSUSE:Tumbleweed From an advisory covering 2310 CVEs |
before 113.0.5672.92-1.1 | 113.0.5672.92-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-3449 is a high vulnerability (CVSS 8.8) in Google Chrome, published October 13, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.52%, the 44th percentile. Fixed in chromium 106.0.5249.119-1.
References
chromereleases.googleblog.com/2022/10/stable-channel-update-for-desktop_11.html
crbug.com/1364662
security.gentoo.org/glsa/202305-10
nvd.nist.gov/vuln/detail/CVE-2022-3449
github.com/advisories/GHSA-9692-35cp-x87f
security-tracker.debian.org/tracker/CVE-2022-3449
Show 194 moreShow less
advisories.mageia.org/MGASA-2022-0376.html
bugs.mageia.org/show_bug.cgi?id=30961
blog.chromium.org/2022/09/chrome-106-beta-new-css-features.html
ubuntu.com/security/CVE-2022-3449
cve.org/CVERecord?id=CVE-2022-3449
lists.opensuse.org/archives/list/[email protected]/thread/NJWEEFPIGYBU2QS5FM2VA25YMZLEGXGF
bugzilla.suse.com/1204223
suse.com/security/cve/CVE-2022-3445
Left out here: 27 versions and 2,133 references. The JSON record has them.