CVE-2022-2861: Inappropriate implementation in Extensions API

Q: What is the severity of CVE-2022-2861?

CVE-2022-2861 has been classified with a high severity rating due to the potential for remote code execution through malicious Chrome extensions.

Q: How do I fix CVE-2022-2861?

To resolve CVE-2022-2861, update Google Chrome to version 104.0.5112.101 or later.

Q: What impact does CVE-2022-2861 have on users?

CVE-2022-2861 can allow attackers to inject arbitrary scripts into the WebUI, compromising user security and privacy.

Q: Which software versions are affected by CVE-2022-2861?

CVE-2022-2861 affects Google Chrome versions prior to 104.0.5112.101 and Fedora 37.

Q: Are there any workarounds for CVE-2022-2861?

Currently, the best workaround for CVE-2022-2861 is to refrain from installing unknown or unverified Chrome extensions until an update is applied.

Published Jul 21, 2022

Updated

Inappropriate implementation in Extensions API in Google Chrome prior to 104.0.5112.101 allowed an attacker who convinced a user to install a malicious extension to inject arbitrary scripts into WebUI via a crafted HTML page.

Credit

Rong Jian(VRI)

Affected Software

3 affected componentsFixes available

Google Chrome<104.0.5112.101

104.0.5112.101

Google Chrome<104.0.5112.101

fedoraproject fedora=37

Remediation

Patch Available

https://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop_16.html

Event History

Jul 21, 2022

CVE Published

12:00 AM

Sep 26, 2022

CVE Published

via MITRE·03:01 PM

Data Sourced

via MITRE·03:01 PM

DescriptionWeakness

Data Sourced

via NVD·04:15 PM

RemedyDescriptionSeverityWeaknessAffected Software

Parent advisories

This vulnerability appears in the following advisories.

5720220590878638492

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

What is the severity of CVE-2022-2861?