CVE-2022-0609
mediumpriority · act · 90OT risk · criticalKEV · exploitedEPSS 0.224 · 98 %ileEURUUSadded 2022-02-15remediate by 2022-03-01
required action Apply updates per vendor instructions.
EPSS · scored 2026-10-27
Google Chromium Animation Use-After-Free Vulnerability
Use after free in Animation in Google Chrome prior to 98.0.4758.102 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- FixedConnected Components Workbenchcisa_csaf_ot
Rockwell Automation recommends users to update Connected Components Workbench to R21 and later.
https://compatibility.rockwellautomation.com/Pages/MultiProductCompareSelections.aspx?crumb=113&versions=62094,61582,61171,59954,57681,56704,55972,55834,55171,55113,54814,54367,54015,52536,52079,51735,51580,50987,50897,50616,50061 - MitigationConnected Components Workbenchcisa_csaf_ot
Additionally, Rockwell Automation encourages customers to implement their suggested security best practices to minimize the risk of vulnerability.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.3–8.8
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (21)
Products and version ranges known to be affected.
advisories (2)
Vendor and ecosystem advisories describing this.
- GHSA-vv6j-ww6x-54gxUse after free in Animation2022-02-22ghsa · osvUS
CVE-2022-0609: Use after free in Animation - https://chromereleases.googleblog.com/2022/02/stable-channel-update-for-desktop_14.html - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0609 Google is aware of reports that exploits for CVE-2022-0609 exist in the wild. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. It demands that the victim is doing some kind of user interaction. Technical details are unknown but an exploit is available. There is currently little other public information on the issue other than it has been flagged as `High` severity.
- ICSA-23-264-05Rockwell Automation Connected Components Workbench2023-09-21icsa · cisa_csaf_otUS
Successful exploitation of these vulnerabilities could allow an attacker to exploit heap corruption via a crafted HTML.
also known as (4)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (20)
External citations — patches, advisories, analysis.
- https://chromereleases.googleblog.com/2022/02/stable-channel-update-for-desktop_14.htmlcnnvd
- https://crbug.com/1296150cnnvd
- https://cxsecurity.com/cveshow/CVE-2022-0609/cnnvd
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-0609cnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2022-0609cnnvd
- https://packetstormsecurity.com/files/166081/Gentoo-Linux-Security-Advisory-202202-03.htmlcnnvd
- https://packetstormsecurity.com/files/169224/Debian-Security-Advisory-5079-1.htmlcnnvd
- https://vigilance.fr/vulnerability/Chrome-multiple-vulnerabilities-37563cnnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan