Improperly implemented security check for standard in Google Chromium - CVE-2022-0291

Vulnerability identifier: #VU59850

CSH Severity: Medium

CVSS v4: 7.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-0291

CWE-ID: CWE-358

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to incorrect implementation in Storage in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and compromise the system.

Google Chromium
Google Chrome
Microsoft Edge
Gentoo Linux
Chrome OS
chromium (Debian package)

Update to version 97.0.4692.99.

Google Chromium - update to 97.0.4692.99
Google Chrome - update to 97.0.4692.99
chromium (Debian package) - update to 97.0.4692.99-1~deb11u2
Microsoft Edge - update to 97.0.1072.69
Chrome OS - update to 96.0.4664.180

• https://chromereleases.googleblog.com/2022/01/stable-channel-update-for-desktop_19.html
• https://crbug.com/1281084
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-0291

• Multiple vulnerabilities in Google Chrome
• Multiple vulnerabilities in Microsoft Edge
• Debian update for chromium
• Gentoo update for Chromium, Google Chrome
• Multiple vulnerabilities in Google Chrome OS LTS