CVE-2022-2856

Google Chromium Intents Insufficient Input Validation Vulnerability

Severity Score

6.5

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

Yes

*KEV

Decision

Attend

*SSVC

Descriptions

Insufficient validation of untrusted input in Intents in Google Chrome on Android prior to 104.0.5112.101 allowed a remote attacker to arbitrarily browse to a malicious website via a crafted HTML page.

Una comprobación insuficiente de entradas no confiables en Intents en Google Chrome en Android versiones anteriores a 104.0.5112.101, permitía a un atacante remoto navegar arbitrariamente a un sitio web malicioso por medio de una página HTML diseñada.

Google Chromium Intents contains an insufficient validation of untrusted input vulnerability that allows a remote attacker to browse to a malicious website via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

*Credits: N/A

CVSS Scores

NISTv3.1 6.5

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:Attend

Exploitation

Active

Automatable

Tech. Impact

Partial

* Organization's Worst-case Scenario

Timeline

2022-08-16 CVE Reserved
2022-08-18 Exploited in Wild
2022-08-28 CVE Published
2022-09-08 KEV Due Date
2024-08-03 CVE Updated
2024-08-03 First Exploit
2024-08-15 EPSS Updated

CWE

CWE-20: Improper Input Validation

CAPEC

References (3)

URL	Tag	Source

URL	Date	SRC
https://crbug.com/1345630	2024-08-03

URL	Date	SRC
https://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop_16.html	2024-07-08

URL	Date	SRC
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4NMJURTG5RO3TGD7ZMIQ6Z4ZZ3SAVYE	2024-07-08

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Google Search vendor "Google"	Chrome Search vendor "Google" for product "Chrome"	< 104.0.5112.101 Search vendor "Google" for product "Chrome" and version " < 104.0.5112.101"	-	Affected	in	Apple Search vendor "Apple"	Macos Search vendor "Apple" for product "Macos"	-	-	Safe
Google Search vendor "Google"	Chrome Search vendor "Google" for product "Chrome"	< 104.0.5112.102 Search vendor "Google" for product "Chrome" and version " < 104.0.5112.102"	-	Affected	in	Microsoft Search vendor "Microsoft"	Windows Search vendor "Microsoft" for product "Windows"	-	-	Safe
Fedoraproject Search vendor "Fedoraproject"		Fedora Search vendor "Fedoraproject" for product "Fedora"				37 Search vendor "Fedoraproject" for product "Fedora" and version "37"		-		Affected