PT-2021-6341 · Google+2 · Google Chrome+2

Abdelhamid Naceri · Published 2021-12-12 · Updated 2024-06-15 · CVE-2022-0799

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 99.0.4844.51

Description The issue is related to insufficient policy enforcement in the Installer component of Google Chrome, allowing a remote attacker to perform local privilege escalation via a crafted offline installer file. This could potentially bypass security restrictions.

Recommendations For Google Chrome versions prior to 99.0.4844.51, update to version 99.0.4844.51 or later to resolve the issue. As a temporary workaround, consider restricting the use of offline installer files until the update is applied.

Exploit

Fix

LPE

Information Disclosure

Link Following

Weakness Enumeration

CWE-200

CWE-59

Related Identifiers

ALT-PU-2022-1431

ALT-PU-2022-1580

ALT-PU-2022-1681

ALT-PU-2022-2055

BDU:2022-01354

CVE-2022-0799

DSA-5089-1

OPENSUSE-SU-2022:0075-1

OPENSUSE-SU-2022:0103-1

OPENSUSE-SU-2022:0110-1

OPENSUSE-SU-2022_0103-1

OPENSUSE-SU-2022_0110-1

OPENSUSE-SU-2024:11890-1

OPENSUSE-SU-2024:12948-1

Affected Products

Alt Linux

Google Chrome

Suse

References · 2348

• 🔥 https://github.com/Phuong39/PoC-CVE-2021-30632 · Exploit
• 🔥 https://github.com/ZeusBox/CVE-2021-37980 · Exploit
• 🔥 https://github.com/SpiralBL0CK/Chrome-V8-RCE-CVE-2021-38003 · Exploit
• 🔥 https://github.com/CrackerCat/CVE-2021-30632 · Exploit
• 🔥 https://github.com/Peterpan0927/TFC-Chrome-v8-bug-CVE-2021-38001-poc · Exploit
• 🔥 https://github.com/xmzyshypnc/CVE-2021-30551 · Exploit
• 🔥 https://github.com/maldiohead/TFC-Chrome-v8-bug-CVE-2021-38001-poc · Exploit
• 🔥❌ https://github.com/Lagal1990/CVE-2021-30632 · Exploit, Deleted
• 🔥❌ https://github.com/Expdev893/CVE-2021-30632 · Exploit, Deleted
• https://cve.org/CVERecord?id=CVE-2022-0799 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-0799 · Vendor Advisory
• https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop.html · Vendor Advisory
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-0799 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:12948-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2022:0110-1 · Vendor Advisory