CVE-2022-4926

2023-07-2900:00:00

ubuntu.com

google chrome

android

policy enforcement

same origin

remote attacker

html page

chromium

medium severity

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

0.001 Low

EPSS

Percentile

41.6%

JSON

Insufficient policy enforcement in Intents in Google Chrome on Android
prior to 109.0.5414.119 allowed a remote attacker to bypass same origin
policy via a crafted HTML page. (Chromium security severity: Medium)

Notes

Author	Note
sbeattie	Chrome on Android only
alexmurray	The Debian chromium source package is called chromium-browser in Ubuntu
mdeslaur	starting with Ubuntu 19.10, the chromium-browser package is just a script that installs the Chromium snap