CVE-2022-0108: Inappropriate implementation in Navigation
An inappropriate implementation flaw was found in the Navigation component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=1248444
External References:
https://chromereleases.googleblog.com/2022/01/stable-channel-update-for-desktop.html
Other sources
Inappropriate implementation in Navigation in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
WebKit. This issue was addressed with improved iframe sandbox enforcement.
— Apple
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/chromium-browserto a version that resolves this vulnerability.Fixed in 97.0.4692.71-0ubuntu0.18.04.1 - Upgrade
Upgrade
ubuntu/webkit2gtkto a version that resolves this vulnerability.Fixed in 2.38.6-0ubuntu0.20.04.1 - Upgrade
Upgrade
ubuntu/webkit2gtkto a version that resolves this vulnerability.Fixed in 2.38.6-0ubuntu0.22.04.1 - Upgrade
Upgrade
ubuntu/webkit2gtkto a version that resolves this vulnerability.Fixed in 2.38.6-0ubuntu0.22.10.1 - Upgrade
Upgrade
ubuntu/webkit2gtkto a version that resolves this vulnerability.Fixed in 2.40.1-0ubuntu0.23.04.1 - Upgrade
Upgrade
tvOSto a version that resolves this vulnerability.Fixed in 16.3 - Upgrade
Upgrade
Apple iOS, iPadOS, and watchOSto a version that resolves this vulnerability.Fixed in 9.3 - Upgrade
Upgrade
macOS Venturato a version that resolves this vulnerability.Fixed in 13.2 - Upgrade
Upgrade
Google Chrome (Trace Event)to a version that resolves this vulnerability.Fixed in 97.0.4692.71 - Upgrade
Upgrade
Safarito a version that resolves this vulnerability.Fixed in 16.3 - Upgrade
Upgrade
Apple iOS and iPadOSto a version that resolves this vulnerability.Fixed in 16.3 - Upgrade
Upgrade
Apple iOS, iPadOS, and macOSto a version that resolves this vulnerability.Fixed in 16.3 - Upgrade
Upgrade
redhat/chromium-browserto a version that resolves this vulnerability.Fixed in 97.0.4692.71 - Upgrade
Upgrade
alpine/qt5-qtwebengineto a version that resolves this vulnerability.Fixed in 5.15.3_git20211127-r4 - Upgrade
Upgrade
alpine/qt5-qtwebengineto a version that resolves this vulnerability.Fixed in 5.15.3_git20220121-r4 - Upgrade
Upgrade
debian/chromiumto a version that resolves this vulnerability.Fixed in 97.0.4692.71-0.1 - Upgrade
Upgrade
debian/webkit2gtkto a version that resolves this vulnerability.Fixed in 2.40.1-1 - Upgrade
Upgrade
debian/wpewebkitto a version that resolves this vulnerability.Fixed in 2.38.6-1 - Upgrade
Upgrade
debian/chromiumto a version that resolves this vulnerability.Fixed in 150.0.7871.100-1~deb12u1Fixed in 156.0.8078.79-1~deb12u1Fixed in 150.0.7871.181-1~deb13u1Fixed in 156.0.8078.79-1~deb13u1Fixed in 156.0.8078.79-1 - Upgrade
Upgrade
debian/webkit2gtkto a version that resolves this vulnerability.Fixed in 2.50.6-1~deb12u2Fixed in 2.50.6-1~deb12u1Fixed in 2.52.6-1~deb13u1Fixed in 2.54.0-1~deb13u3Fixed in 2.52.6-1Fixed in 2.54.2-2 - Upgrade
Upgrade
debian/wpewebkitto a version that resolves this vulnerability.Fixed in 2.38.6-1Fixed in 2.48.3-1Fixed in 2.54.2-1 - Upgrade
Upgrade
Google Chrometo a version that resolves this vulnerability.Fixed in 97.0.4692.71
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
- CVE-2023-32438
- CVE-2023-23499
- CVE-2023-23520
- CVE-2023-41990
- CVE-2023-23519
- CVE-2023-23500
- CVE-2023-23502
- CVE-2023-23504
- CVE-2023-23503
- CVE-2023-23512
- CVE-2023-23511
- CVE-2023-32393
- CVE-2022-0108
- CVE-2023-23496
- CVE-2023-23518
- CVE-2023-23517
- CVE-2023-23505
- CVE-2022-42915
- CVE-2022-42916
- CVE-2022-32221
- CVE-2022-35260
- CVE-2023-23539
- CVE-2023-23513
- CVE-2023-23493
- CVE-2023-23530
- CVE-2023-23531
- CVE-2023-23507
- CVE-2023-23516
- CVE-2023-23506
- CVE-2023-23498
- CVE-2023-28208
- CVE-2023-23497
- CVE-2023-23510
- CVE-2022-3705
- CVE-2023-23501
- CVE-2023-23508
- CVE-2022-0096
- CVE-2022-0097
- CVE-2022-0098
- CVE-2022-0099
- CVE-2022-0100
- CVE-2022-0101
- CVE-2022-0337
- CVE-2022-0102
- CVE-2022-0103
- CVE-2022-4924
- CVE-2022-0104
- CVE-2022-0105
- CVE-2022-0106
- CVE-2022-0107
- CVE-2022-0109
- CVE-2022-0110
- CVE-2022-0111
- CVE-2022-0112
- CVE-2022-0113
- CVE-2022-0114
- CVE-2022-0115
- CVE-2022-0116
- CVE-2022-0117
- CVE-2022-0118
- CVE-2022-0120
- CVE-2022-4925
- CVE-2023-23529
- DLA-3419-1
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2022-0108.
What is the title of the vulnerability?
The title of the vulnerability is WebKit.
What is the description of the vulnerability?
The vulnerability is related to inappropriate implementation in Navigation in Google Chrome prior to version 97.0.4692.71, allowing a remote attacker to leak cross-origin data via a crafted HTML page.
What software are affected by this vulnerability?
The following software are affected by this vulnerability: Apple Safari up to version 16.3, Ubuntu Chromium Browser up to version 97.0.4692.71-0ubuntu0.18.04.1, Ubuntu Webkit2gtk up to version 2.38.6-0ubuntu0.20.04.1, Ubuntu Webkit2gtk up to version 2.38.6-0ubuntu0.22.04.1, Ubuntu Webkit2gtk up to version 2.38.6-0ubuntu0.22.10.1, Ubuntu Webkit2gtk up to version 2.40.1-0ubuntu0.23.04.1, Debian Chromium up to version 90.0.4430.212-1~deb10u1, Debian Webkit2gtk up to version 2.36.4-1~deb10u1, Debian Webkit2gtk up to version 2.38.5-1~deb11u1, Debian Wpewebkit up to version 2.38.5-1~deb11u1, Apple watchOS up to version 9.3, Apple tvOS up to version 16.3, Apple macOS Ventura up to version 13.2, Apple iOS up to version 16.3, and Apple iPadOS up to version 16.3.
What is the severity of this vulnerability?
The severity of this vulnerability is not mentioned.
Is there a fix available for this vulnerability?
Yes, the fix for this vulnerability is available in Apple Safari version 16.3, Ubuntu Chromium Browser version 97.0.4692.71-0ubuntu0.18.04.1, Ubuntu Webkit2gtk version 2.38.6-0ubuntu0.20.04.1, Ubuntu Webkit2gtk version 2.38.6-0ubuntu0.22.04.1, Ubuntu Webkit2gtk version 2.38.6-0ubuntu0.22.10.1, Ubuntu Webkit2gtk version 2.40.1-0ubuntu0.23.04.1, Debian Chromium version 90.0.4430.212-1~deb10u1, Debian Webkit2gtk version 2.36.4-1~deb10u1, Debian Webkit2gtk version 2.38.5-1~deb11u1, Debian Wpewebkit version 2.38.5-1~deb11u1, Apple watchOS version 9.3, Apple tvOS version 16.3, Apple macOS Ventura version 13.2, Apple iOS version 16.3, and Apple iPadOS version 16.3.