CVE-2022-3310: Insufficient policy enforcement in Custom Tabs
Published Aug 16, 2021
·Updated
Insufficient policy enforcement in custom tabs in Google Chrome on Android prior to 106.0.5249.62 allowed an attacker who convinced the user to install an application to bypass same origin policy via a crafted application. (Chromium security severity: Medium)
Credit
Ashwin Agrawal(Optus), Sydney
Affected Software
6 affected componentsFixes available
debian/chromium<=90.0.4430.212-1~deb10u1
116.0.5845.180-1~deb11u1120.0.6099.109-1~deb11u1119.0.6045.199-1~deb12u1120.0.6099.109-1~deb12u1120.0.6099.109-1
Google Chrome<106.0.5249.61
106.0.5249.61
Google Chrome<106.0.5249.62
Google Android
All of the following
Google Chrome<106.0.5249.62
Google Android
Event History
Aug 16, 2021
CVE Published
12:00 AM
Nov 1, 2022
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
DescriptionWeakness
Data Sourced
via NVD·08:15 PM
DescriptionSeverityWeaknessAffected Software
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
1
What is the severity of CVE-2022-3310?
The severity of CVE-2022-3310 is classified as Medium.
2
How do I fix CVE-2022-3310?
To fix CVE-2022-3310, upgrade Google Chrome to version 106.0.5249.61 or later.
3
Who is affected by CVE-2022-3310?
CVE-2022-3310 affects users of Google Chrome on Android prior to version 106.0.5249.62.
4
What type of vulnerability is CVE-2022-3310?
CVE-2022-3310 is an insufficient policy enforcement vulnerability.
5
Can CVE-2022-3310 be exploited remotely?
Yes, CVE-2022-3310 can potentially be exploited if an attacker convinces the user to install a malicious application.