CVE-2022-2619: Insufficient validation of untrusted input in Settings

Q: What is the vulnerability ID for this vulnerability?

The vulnerability ID for this vulnerability is CVE-2022-2619.

Q: What is the severity of CVE-2022-2619?

The severity of CVE-2022-2619 is medium.

Q: What software is affected by CVE-2022-2619?

Google Chrome versions prior to 104.0.5112.79 and Fedora 37 are affected by CVE-2022-2619.

Q: How can an attacker exploit CVE-2022-2619?

An attacker who convinces a user to install a malicious extension can inject scripts or HTML into a privileged page via a crafted HTML page.

Q: How can I fix CVE-2022-2619?

Update Google Chrome to version 104.0.5112.79 or later to fix CVE-2022-2619.

Published Jun 4, 2022

Updated

Insufficient validation of untrusted input in Settings in Google Chrome prior to 104.0.5112.79 allowed an attacker who convinced a user to install a malicious extension to inject scripts or HTML into a privileged page via a crafted HTML page.

Credit

Oliver Dunk

Affected Software

7 affected componentsFixes available

Google Chrome<104.0.5112.79

104.0.5112.79

Google Chrome<104.0.5112.79

Fedoraproject Fedora=37

debian/chromium<104.0.5112.79-1

104.0.5112.79-1

debian/chromium<104.0.5112.79-1

104.0.5112.79-1

debian/chromium<104.0.5112.79-1

104.0.5112.79-1

debian/chromium

150.0.7871.100-1~deb12u1156.0.8078.79-1~deb12u1150.0.7871.181-1~deb13u1156.0.8078.79-1~deb13u1156.0.8078.79-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Google Chrome (Trace Event) to a version that resolves this vulnerability.
Fixed in 104.0.5112.79
Upgrade
Upgrade debian/chromium to a version that resolves this vulnerability.
Fixed in 104.0.5112.79-1
Upgrade
Upgrade debian/chromium to a version that resolves this vulnerability.
Fixed in 150.0.7871.100-1~deb12u1Fixed in 156.0.8078.79-1~deb12u1Fixed in 150.0.7871.181-1~deb13u1Fixed in 156.0.8078.79-1~deb13u1Fixed in 156.0.8078.79-1
Upgrade
Upgrade Google Chrome to a version that resolves this vulnerability.
Fixed in 104.0.5112.79

Event History

Jun 4, 2022

CVE Published

12:00 AM

Aug 12, 2022

CVE Published

via MITRE·07:37 PM

Data Sourced

via MITRE·07:37 PM

DescriptionWeakness

Data Sourced

via OSV·08:15 PM

DescriptionSeverityAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

What is the vulnerability ID for this vulnerability?

The vulnerability ID for this vulnerability is CVE-2022-2619.

What is the severity of CVE-2022-2619?

The severity of CVE-2022-2619 is medium.

What software is affected by CVE-2022-2619?

Google Chrome versions prior to 104.0.5112.79 and Fedora 37 are affected by CVE-2022-2619.

How can an attacker exploit CVE-2022-2619?

An attacker who convinces a user to install a malicious extension can inject scripts or HTML into a privileged page via a crafted HTML page.

How can I fix CVE-2022-2619?

Update Google Chrome to version 104.0.5112.79 or later to fix CVE-2022-2619.

CVE-2022-2619: Insufficient validation of untrusted input in Settings

Credit

Affected Software

Remediation

Event History

Parent advisories

Peer vulnerabilities

Frequently Asked Questions

What is the vulnerability ID for this vulnerability?

What is the severity of CVE-2022-2619?

What software is affected by CVE-2022-2619?

How can an attacker exploit CVE-2022-2619?

How can I fix CVE-2022-2619?

Company

Resources

Contact