PT-2023-5988 · Google · Google Chrome

Published 2023-03-01 · Updated 2023-08-31 · CVE-2022-4452

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 107.0.5304.62

Description The issue is related to insufficient data validation in the crosvm component of Google Chrome, which could allow a remote attacker to exploit object corruption via a crafted HTML page. This could potentially impact the confidentiality, integrity, and availability of protected information.

Recommendations For versions prior to 107.0.5304.62, update to version 107.0.5304.62 or later to resolve the issue. As a temporary workaround, consider restricting access to potentially vulnerable HTML pages until the update is applied.

Fix

Information Disclosure

Weakness Enumeration

CWE-19

CWE-200

Related Identifiers

ASB-A-251802307

BDU:2023-06689

CVE-2022-4452

Affected Products

Google Chrome

References · 14

• https://osv.dev/vulnerability/CVE-2022-4452 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-4452 · Security Note
• https://crbug.com/1372457 · Vendor Advisory
• https://bugs.chromium.org/p/chromium/issues/detail?id=1372457 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-06689 · Security Note
• https://osv.dev/vulnerability/ASB-A-251802307 · Vendor Advisory
• https://source.android.com/security/bulletin/2023-03-01 · Note
• https://twitter.com/vuldb/status/1695113188201869819 · Twitter Post
• https://t.me/cvenotify/57295 · Telegram Post
• https://t.me/cvenotify/57317 · Telegram Post
• https://vuldb.com/ru/?id.238050 · Note
• https://android.googlesource.com/platform/external/crosvm/+/2cd328fdf17c1bf0f979bf4c728538f6edb0761e · Note
• https://twitter.com/CVEnew/status/1695086953350254699 · Twitter Post
• https://cybersecurity-help.cz/vdb/SB2023030649 · Note