CVE-2022-3310 : Insufficient policy enforcement in custom tabs in Google Chrome on Android prior

Insufficient policy enforcement in custom tabs in Google Chrome on Android prior to 106.0.5249.62 allowed an attacker who convinced the user to install an application to bypass same origin policy via a crafted application. (Chromium security severity: Medium)

Published 2022-11-01 20:15:21

Updated 2022-12-09 15:48:50

Source Chrome

View at NVD, CVE.org

Products affected by CVE-2022-3310

Google » Chrome
Versions before (<) 106.0.5249.62
cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
Matching versions
When used together with: Google » Android » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2022-3310

EPSS FAQ

0.08%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 34 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2022-3310

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
6.5	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N	2.8	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Unchanged Confidentiality: None Integrity: High Availability: None

References for CVE-2022-3310

https://crbug.com/1240065

Sign in - Google Accounts
Exploit;Issue Tracking;Vendor Advisory
https://chromereleases.googleblog.com/2022/09/stable-channel-update-for-desktop_27.html

Chrome Releases: Stable Channel Update for Desktop
Release Notes;Vendor Advisory

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2022-3310

Products affected by CVE-2022-3310

Exploit prediction scoring system (EPSS) score for CVE-2022-3310

CVSS scores for CVE-2022-3310

References for CVE-2022-3310