Actively exploited · Published Sep 26, 2022 · Assigned by Chrome

CVE-2022-2856

Medium 6.5 Exploited

In plain English

A medium-severity improper input validation in Chrome from Google. Attackers are actively exploiting it in the wild (listed by CISA on August 18, 2022). The chance it is exploited in the next 30 days is estimated at 4.6% (higher than 92% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)4.6%top 8.4% of all CVEs

Exploited in the wildYesCISA KEV since Aug 18, 2022

Attack toolingNoneno public tooling known

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by Sep 8, 2022.

Official description

Insufficient validation of untrusted input in Intents in Google Chrome on Android prior to 104.0.5112.101 allowed a remote attacker to arbitrarily browse to a malicious website via a crafted HTML page.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	chromium	104.0.5112.101-1	DEBIAN-CVE-2022-2856
Debian:13	chromium	104.0.5112.101-1	DEBIAN-CVE-2022-2856
Debian:14	chromium	104.0.5112.101-1	DEBIAN-CVE-2022-2856

Affected products (as reported)

Vendor	Product	Versions
Google	Chrome	unspecified – before 104.0.5112.101

Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

References

https://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop_16.html x_refsource_MISC
https://crbug.com/1345630 x_refsource_MISC
FEDORA-2022-3f28aa88cf vendor-advisory, x_refsource_FEDORA
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-2856 government-resource