CVE-2022-32969: Medium severity metamask vulnerability
MetaMask before 10.11.3 might allow an attacker to access a user's secret recovery phrase because an input field is used for a BIP39 mnemonic, and Firefox and Chromium save such fields to disk in order to support the Restore Session feature, aka the Demonic issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2022-32969?
CVE-2022-32969 is considered a critical vulnerability as it exposes users' secret recovery phrases.
How do I fix CVE-2022-32969?
To fix CVE-2022-32969, update MetaMask to version 10.11.3 or later.
What is the risk associated with CVE-2022-32969?
The risk associated with CVE-2022-32969 is that attackers could potentially access sensitive recovery phrases stored in the browser.
Which versions of MetaMask are affected by CVE-2022-32969?
Versions of MetaMask before 10.11.3 are affected by CVE-2022-32969.
What specific issue does CVE-2022-32969 address?
CVE-2022-32969 addresses an issue where secret recovery phrases may be saved to disk by browsers, enabling unauthorized access.