CVE-2022-2856: medium-severity vulnerability in Google Chrome
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA.
Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.
Apply updates per vendor instructions.
Google Chrome on Android failed to properly validate malicious links in app intents, allowing attackers to redirect users to harmful websites through a crafted webpage.
CWE-20 insufficient input validation in Intent handling on Android Chrome prior to 104.0.5112.101 allows remote attackers to bypass intent validation and redirect to arbitrary URLs via crafted HTML, requiring user interaction with the malicious page.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.