PT-2022-1598 · Google+3 · Google Chrome+3

Published 2022-02-01 · Updated 2024-06-15 · CVE-2022-0461

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 98.0.4758.80

Description The issue is related to a policy bypass in the COOP component of Google Chrome, which is associated with insufficient access control. This allows a remote attacker to bypass iframe sandbox restrictions via a crafted HTML page, potentially gaining access to confidential information.

Recommendations For versions prior to 98.0.4758.80, update to version 98.0.4758.80 or later to resolve the issue. At the moment, there is no information about additional mitigation measures for this specific issue.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

ALT-PU-2022-1216

ALT-PU-2022-1323

ALT-PU-2022-1681

ALT-PU-2022-2055

BDU:2022-00817

CVE-2022-0461

DSA-5068-1

OPENSUSE-SU-2022:0030-1

OPENSUSE-SU-2022:0110-1

OPENSUSE-SU-2022_0050-1

OPENSUSE-SU-2022_0110-1

OPENSUSE-SU-2024:11811-1

OPENSUSE-SU-2024:11985-1

OPENSUSE-SU-2024:12948-1

Affected Products

Alt Linux

Astra Linux

Google Chrome

Suse

References · 2346

• 🔥 https://github.com/ZeusBox/CVE-2021-37980 · Exploit
• 🔥 https://github.com/Phuong39/PoC-CVE-2021-30632 · Exploit
• 🔥 https://github.com/SpiralBL0CK/Chrome-V8-RCE-CVE-2021-38003 · Exploit
• 🔥 https://github.com/CrackerCat/CVE-2021-30632 · Exploit
• 🔥 https://github.com/xmzyshypnc/CVE-2021-30551 · Exploit
• 🔥 https://github.com/Peterpan0927/TFC-Chrome-v8-bug-CVE-2021-38001-poc · Exploit
• 🔥 https://github.com/maldiohead/TFC-Chrome-v8-bug-CVE-2021-38001-poc · Exploit
• 🔥❌ https://github.com/Lagal1990/CVE-2021-30632 · Exploit, Deleted
• 🔥❌ https://github.com/Expdev893/CVE-2021-30632 · Exploit, Deleted
• https://osv.dev/vulnerability/DSA-5068-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-00817 · Security Note
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2022-0926SE47 · Vendor Advisory
• https://chromereleases.googleblog.com/2022/02/stable-channel-update-for-desktop.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-0461 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:11811-1 · Vendor Advisory