CVE-2022-3201: Insufficient validation of untrusted input in Developer Tools
Insufficient validation of untrusted input in DevTools in Google Chrome on Chrome OS prior to 105.0.5195.125 allowed an attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: High)
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Google Chrome (Trace Event)to a version that resolves this vulnerability.Fixed in 106.0.5249.61 - Upgrade
Upgrade
alpine/qt5-qtwebengineto a version that resolves this vulnerability.Fixed in 5.15.3_git20220505-r4 - Upgrade
Upgrade
alpine/qt5-qtwebengineto a version that resolves this vulnerability.Fixed in 5.15.11-r3 - Upgrade
Upgrade
debian/chromiumto a version that resolves this vulnerability.Fixed in 106.0.5249.61-1 - Upgrade
Upgrade
debian/chromiumto a version that resolves this vulnerability.Fixed in 150.0.7871.100-1~deb12u1Fixed in 156.0.8078.79-1~deb12u1Fixed in 150.0.7871.181-1~deb13u1Fixed in 156.0.8078.79-1~deb13u1Fixed in 156.0.8078.79-1 - Upgrade
Upgrade
Google Chrome on Chrome OSto a version that resolves this vulnerability.Fixed in 105.0.5195.125
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is CVE-2022-3201?
CVE-2022-3201 is a vulnerability in DevTools in Google Chrome on Chrome OS prior to version 105.0.5195.125.
What is the severity of CVE-2022-3201?
The severity of CVE-2022-3201 is Medium with a score of 5.4 (out of 10).
How does CVE-2022-3201 allow an attacker to bypass navigation restrictions?
CVE-2022-3201 allows an attacker who convinced a user to install a malicious extension to bypass navigation restrictions through a crafted HTML page.
Which software versions are affected by CVE-2022-3201?
Google Chrome on Chrome OS prior to version 105.0.5195.125 is affected by CVE-2022-3201.
How can I fix CVE-2022-3201?
To fix CVE-2022-3201, update Google Chrome to version 105.0.5195.125 or later.