Use after free in Web Authentication in Google Chrome prior to 149.0.7827.197 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension. (Chromium security severity: High)
| Vendor | Product | Versions |
|---|---|---|
| chrome | 149.0.7827.197 |
Downstream vendors/products affected by this vulnerability
| Vendor | Product | Source | Confidence |
|---|---|---|---|
| apple | macos | cve_cpe | 95% |
| chrome | cert_advisory | 90% | |
| linux | linux_kernel | cve_cpe | 95% |
| microsoft | windows | cve_cpe | 95% |
Updated vendor to Microsoft and product to Edge, marked exploit as available, and noted no specific patch version available.
Updated severity to CRITICAL, affected versions to include 149.0.7827.155, and noted that the vulnerability is actively exploited.
Initial creation
