PT-2022-6771 · Google+1 · Google Chrome+1

Kaijie Xu · Published 2022-10-25 · Updated 2023-08-10 · CVE-2022-4909

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 107.0.5304.62

Description The issue is related to an inappropriate implementation in XML, allowing a remote attacker to potentially perform an ASLR bypass via a crafted HTML page. This is due to insufficient access control in the XML component of the browser. The exploitation of this issue may enable an attacker to bypass the ASLR protection mechanism.

Recommendations For versions prior to 107.0.5304.62, update to version 107.0.5304.62 or later to resolve the issue. As a temporary workaround, consider restricting access to crafted HTML pages that could exploit this issue.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BDU:2023-04579

CVE-2022-4909

DSA-5261-1

Affected Products

Astra Linux

Google Chrome

References · 12

• 🔥 https://github.com/momika233/CVE-2022-3656 · Exploit
• 🔥 https://crbug.com/1356211 · Exploit
• https://bdu.fstec.ru/vul/2023-04579 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-4909 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5261-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-4909 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/B6SAST6CB5KKCQKH75ER2UQ3ICYPHCIZ · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-4909 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-4909 · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/2LE64KGGOISKPKMYROSDT4K6QFVDIRF6 · Vendor Advisory
• https://chromereleases.googleblog.com/2022/10/stable-channel-update-for-desktop_25.html · Vendor Advisory
• https://t.me/cvenotify/55516 · Telegram Post