PT-2023-4137 · Google · Google Chrome

Axel Chong · Published 2023-01-26 · Updated 2024-10-29 · CVE-2022-4926

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 109.0.5414.119

Description The issue is related to insufficient policy enforcement in Intents, allowing a remote attacker to bypass the same origin policy via a crafted HTML page. This could potentially enable the attacker to circumvent existing security restrictions.

Recommendations For Google Chrome on Android versions prior to 109.0.5414.119, update to version 109.0.5414.119 or later to resolve the issue. As a temporary workaround, consider restricting the use of Intents in Google Chrome on Android until a patch is applied.

Exploit

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

CWE-942

Related Identifiers

BDU:2023-04446

CVE-2022-4926

DSA-5328-1

Affected Products

Google Chrome

References · 11

• 🔥 https://crbug.com/1368230 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-4926 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-4926 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5328-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-4926 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/PQKT7EGDD2P3L7S3NXEDDRCPK4NNZNWJ · Vendor Advisory
• https://chromereleases.googleblog.com/2023/01/stable-channel-update-for-desktop_24.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-4926 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-04446 · Security Note
• https://t.me/cibsecurity/67412 · Telegram Post
• https://t.me/cvenotify/99895 · Telegram Post