PT-2022-6772 · Google+1 · Google Chrome+1

Masato Kinugawa · Published 2022-09-27 · Updated 2023-08-19 · CVE-2022-4911

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 106.0.5249.62

Description The issue is related to insufficient data validation in DevTools, allowing a remote attacker to bypass content security policy via a crafted HTML page. This could potentially impact a significant number of devices worldwide, given the popularity of Google Chrome. However, specific numbers of potentially affected devices are not provided.

Recommendations For versions prior to 106.0.5249.62, update to version 106.0.5249.62 or later to resolve the issue. As a temporary workaround, consider restricting access to DevTools until the update is applied.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2023-04583

CVE-2022-4911

DSA-5244-1

Affected Products

Astra Linux

Google Chrome

References · 11

• 🔥 https://crbug.com/1349493 · Exploit
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/PQKT7EGDD2P3L7S3NXEDDRCPK4NNZNWJ · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5244-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-04583 · Security Note
• https://chromereleases.googleblog.com/2022/09/stable-channel-update-for-desktop_27.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-4911 · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/YKLJ3B3D5BCVWE3QNP4N7HHF26OHD567 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-4911 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-4911 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-4911 · Vendor Advisory
• https://t.me/cvenotify/55514 · Telegram Post