PT-2022-6766 · Google+1 · Google Chrome+1

Alesandro Ortiz · CVE-2022-4910 · Published 2022-10-25 · Updated 2023-08-10

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 107.0.5304.62

Description The issue is related to an inappropriate implementation in the Autofill feature of Google Chrome, which allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. This is due to incorrect authorization in the Autofill function. The estimated number of potentially affected devices and details about real-world incidents where this issue was exploited are not provided.

Recommendations For versions prior to 107.0.5304.62, update to version 107.0.5304.62 or later to resolve the issue. As a temporary workaround, consider disabling the Autofill feature until a patch is available. Restrict access to potentially vulnerable HTML pages to minimize the risk of exploitation.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

BDU:2023-04405

CVE-2022-4910

DSA-5261-1

Affected Products

Astra Linux

Google Chrome

References · 13

• 🔥 https://github.com/momika233/CVE-2022-3656 · Exploit
• 🔥 https://crbug.com/1279268 · Exploit
• https://security-tracker.debian.org/tracker/CVE-2022-4910 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/2LE64KGGOISKPKMYROSDT4K6QFVDIRF6 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5261-1 · Vendor Advisory
• https://chromereleases.googleblog.com/2022/10/stable-channel-update-for-desktop_25.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-4910 · Security Note
• https://osv.dev/vulnerability/CVE-2022-4910 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/B6SAST6CB5KKCQKH75ER2UQ3ICYPHCIZ · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-4910 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-04405 · Security Note
• https://t.me/cvenotify/55515 · Telegram Post
• https://t.me/cibsecurity/67399 · Telegram Post