PT-2022-6777 · Google+1 · Google Chrome+1

Published 2022-03-01 · Updated 2023-08-12 · CVE-2022-4923

Positive Technologies (AI Summary)

CVSS v2.0

3.6

Low

Base vector

AV:N/AC:H/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 99.0.4844.51

Description The issue is related to an inappropriate implementation in the Omnibox feature of Google Chrome, which could allow an attacker in a privileged network position to perform a man-in-the-middle attack via malicious network traffic. This could potentially enable the attacker to intercept and manipulate sensitive data.

Recommendations For Google Chrome versions prior to 99.0.4844.51, update to version 99.0.4844.51 or later to resolve the issue. As a temporary workaround, consider restricting network access to minimize the risk of exploitation.

Exploit

Fix

Missing Encryption of Sensitive Data

Weakness Enumeration

CWE-311

CWE-300

Related Identifiers

BDU:2023-04630

CVE-2022-4923

DSA-5089-1

Affected Products

Astra Linux

Google Chrome

References · 11

• 🔥 https://crbug.com/1251065 · Exploit
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-4923 · Vendor Advisory
• https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop.html · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/PQKT7EGDD2P3L7S3NXEDDRCPK4NNZNWJ · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-04630 · Security Note
• https://osv.dev/vulnerability/DSA-5089-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-4923 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2022-4923 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-4923 · Vendor Advisory
• https://t.me/cibsecurity/67417 · Telegram Post
• https://t.me/cvenotify/55502 · Telegram Post