PT-2022-15335 · Samsung · Samsung Internet

Hongquan Li · Published 2022-01-14 · Updated 2022-01-21 · CVE-2022-22290

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Samsung Internet versions prior to 16.0.6.23

Description The issue allows attackers to perform domain spoofing via a crafted HTML page, exploiting the incorrect download source UI in the Downloads feature.

Recommendations For versions prior to 16.0.6.23, update to version 16.0.6.23 or later to resolve the issue.

Fix

Improper Handling of Exceptional Conditions

Weakness Enumeration

CWE-755

CWE-703

Related Identifiers

CVE-2022-22290

Affected Products

Samsung Internet

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2022-22290 · Security Note
• https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-22290 · Vendor Advisory
• https://t.me/cibsecurity/35610 · Telegram Post