CVE-2022-2856
Google Chromium Intents Insufficient Input Validation Vulnerability
Description
CVE-2022-2856 is an insufficient input validation vulnerability in Google Chromium's Intents handling that allows a remote attacker to navigate to a malicious website via a crafted HTML page. The flaw affects multiple Chromium-based browsers including Google Chrome, Microsoft Edge, and Opera. By exploiting the insufficient validation of untrusted input in the Intents component, an attacker can craft a specially designed webpage that triggers unintended navigation or actions in the browser. CISA has added CVE-2022-2856 to its Known Exploited Vulnerabilities catalog, confirming active exploitation. With an EPSS score of 3.3% (87th percentile), this vulnerability shows significant exploitation probability.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| chrome | < 104.0.5112.101; < 104.0.5112.102 | |
| fedoraproject | fedora | 37 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
References
- https://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop_16.html(Patch, Release Notes, Vendor Advisory)
- https://crbug.com/1345630(Exploit, Issue Tracking, Mailing List, Vendor Advisory)
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4NMJURTG5RO3TGD7ZMIQ6Z4ZZ3SAVYE/(Mailing List)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-2856(US Government Resource)
Weakness Type
CWE-20: Improper Input Validation
CVE-2022-2856 stems from improper input validation in the Chromium Intents component, where the browser fails to adequately validate untrusted input data before processing Intent-related navigation requests. This insufficient validation allows an attacker to supply crafted input through a malicious HTML page that bypasses expected security restrictions, causing the browser to navigate to unintended destinations or execute unauthorized actions.
Learn more: CWE-20 — Improper Input Validation
Impact Analysis
CVE-2022-2856 is remotely exploitable through crafted web content, requiring no authentication but needing user interaction in the form of visiting a malicious page. The insufficient input validation in the Chromium Intents component can allow an attacker to bypass browser security policies, potentially leading to navigation to malicious sites, triggering of unintended application actions, or further exploitation through downstream vulnerabilities. Because the vulnerability affects the Chromium engine, the impact extends beyond Google Chrome to all Chromium-based browsers including Microsoft Edge and Opera, significantly expanding the affected user base. The EPSS score of 3.3% (87th percentile) indicates a high probability of exploitation attempts, and the confirmed inclusion in the CISA KEV catalog underscores the real-world risk to organizations and individuals.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2022-2856 in the wild by adding it to the Known Exploited Vulnerabilities catalog on August 18, 2022, with a remediation deadline of September 8, 2022. The vulnerability was disclosed through the Chrome Stable Channel Update on August 16, 2022. With an EPSS score of approximately 3.3% (87th percentile), this vulnerability ranks significantly above average in exploitation probability, indicating widespread interest from threat actors. The relatively low barrier to exploitation through crafted web pages makes this vulnerability accessible to a broad range of attackers.
Remediation
- Update Chromium-based browsers immediately: Apply the updates referenced in the Chrome Stable Channel Update from August 16, 2022, which patches the insufficient input validation in the Intents component.
- Ensure all Chromium-based browsers are patched: Since CVE-2022-2856 affects the shared Chromium engine, update not only Google Chrome but also Microsoft Edge, Opera, Brave, and any other Chromium-derived browsers in your environment.
- Enable automatic browser updates: Configure browser update policies through enterprise management tools (Chrome Enterprise, Microsoft Intune) to ensure timely delivery of security patches across all managed endpoints.
- Implement web filtering and threat intelligence feeds: Deploy network-level protections that can identify and block access to known exploit delivery pages targeting this vulnerability.
- Monitor browser crash reports and anomalous navigation patterns: Review endpoint detection logs for unusual browser behavior that may indicate exploitation attempts, such as unexpected intent handling or navigation to suspicious URLs.
Technical Details
CVE-2022-2856 is an insufficient input validation vulnerability in the Intents component of the Chromium browser engine. The Intents system in Chromium handles inter-application communication and navigation requests, translating URLs and data payloads into actions within the browser or external applications. The vulnerability exists because the Intents handler does not sufficiently validate the properties of incoming untrusted input before processing navigation or action requests. An attacker can craft a malicious HTML page that supplies specifically structured input to the Intents handler, bypassing the expected validation checks and causing the browser to perform unintended operations. The attack is delivered remotely through web content, requiring no prior access to the victim's system — the user only needs to visit or be redirected to the attacker's page. Because Chromium serves as the foundation for multiple browsers, the vulnerable code path is present in all Chromium-based browsers.
Frequently Asked Questions
Is CVE-2022-2856 being actively exploited?
Yes. CISA has added CVE-2022-2856 to its Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. The vulnerability was addressed in a Chrome Stable Channel Update on August 16, 2022. Organizations should ensure all Chromium-based browsers are updated immediately.
What products are affected by CVE-2022-2856?
CVE-2022-2856 affects Google Chromium's Intents component, which means all Chromium-based browsers are potentially vulnerable. This includes Google Chrome, Microsoft Edge, Opera, Brave, and other browsers built on the Chromium engine. Versions prior to the August 16, 2022 stable update are affected.
How do I fix CVE-2022-2856?
Update all Chromium-based browsers to the latest available versions that include the fix from the August 16, 2022 stable channel update. This includes Chrome, Edge, Opera, and any other Chromium-derived browsers. Enable automatic updates to ensure timely patching of future vulnerabilities.
How severe is CVE-2022-2856?
CVE-2022-2856 is a significant vulnerability with an EPSS score of 3.3% (87th percentile), indicating above-average exploitation probability. The remote attack vector through crafted web pages combined with the broad impact across all Chromium-based browsers makes this a high-priority patching item. CISA's inclusion in the KEV catalog confirms real-world exploitation.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.