PT-2022-5437 · Google+2 · Google Chrome+2

Published 2022-11-08 · Updated 2024-10-23 · CVE-2022-3890

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 107.0.5304.106

Description The issue is related to a heap buffer overflow in the Crashpad component of Google Chrome on Android. This could allow a remote attacker who has compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. The severity of this issue is considered high.

Recommendations For Google Chrome on Android versions prior to 107.0.5304.106, update to version 107.0.5304.106 or later to resolve the issue. As a temporary workaround, consider restricting access to potentially malicious HTML pages to minimize the risk of exploitation.

Fix

Type Confusion

Memory Corruption

Weakness Enumeration

CWE-843

CWE-787

Related Identifiers

ALT-PU-2022-3175

ALT-PU-2022-7651

ALT-PU-2023-1245

ALT-PU-2023-1410

ALT-PU-2023-1462

ALT-PU-2023-1524

ALT-PU-2023-1572

BDU:2022-06763

CVE-2022-3890

DSA-5275-1

OPENSUSE-SU-2022:10201-1

OPENSUSE-SU-2024:12494-1

OPENSUSE-SU-2024:12590-1

OPENSUSE-SU-2024:12948-1

Affected Products

Alt Linux

Astra Linux

Google Chrome

References · 2338

• https://crbug.com/1380083 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-3890 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-3890 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2023-0131SE47MD · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5275-1 · Vendor Advisory
• https://debian.org/security/2022/dsa-5275 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:12948-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3890 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:12494-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-06763 · Security Note
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2022-1221SE17MD · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-3890 · Security Note
• https://chromereleases.googleblog.com/2022/11/stable-channel-update-for-desktop.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-3890 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2022:10201-1 · Vendor Advisory