Vulnerability Spotlight: Use-after-free condition in Google Chrome WebGPU

Summary: Piotr Bania of Cisco Talos discovered a use-after-free vulnerability, TALOS-2022-1508 (CVE-2022-2399), in Google Chrome's WebGPU JavaScript API for accelerated 3-D graphics. Opening a specially crafted web page could trigger the condition, which an attacker could use to manipulate the browser further; Talos confirmed Chrome versions 102.0.4956.0 and 99.0.4844.82 (64-bit) were exploitable, and Google has released an update.
What's compelling: The exploit path is a single crafted web page opened in Chrome, and Talos confirmed the flaw against specific browser builds, so unpatched endpoints remain exposed until they reach the fixed version. Snort rules 59448 and 59449 detect exploitation attempts, but Talos notes additional rules may follow and current rules are subject to change.

Read the original at Cisco Talos ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2022-2399
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026