Google Chrome Security Updates – 17 August 2022

By /
  • 190/2022
  • High

Google has released an updated Chrome version (104.0.5112.101) for Windows, Mac and Linux to fix several vulnerabilities, including a zero-day flaw that is being exploited in the wild. The remote attacker could exploit these vulnerabilities to take
control of the affected system.

The severity of the addressed vulnerabilities could allow the remote attacker to execute arbitrary code on the affected system by persuading the victim to visit a specially crafted webpage.

Samples of the addressed vulnerabilities:

1. Google Chrome FedCM Code Execution (CVE-2022-2852):

  • CVSS: 8.8
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Consequences: Gain Access

2. Google Chrome Downloads Heap Buffer Overflow (CVE-2022-2853):

  • CVSS: 8.8
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Consequences: Gain Access

It should be highlighted that Google is aware that an exploit for “CVE-2022-2856” exists in the wild, due to improper input validation in the Intents component in Google Chrome.

Vulnerabilities
  • CVE-2022-2852
  • CVE-2022-2854
  • CVE-2022-2855
  • CVE-2022-2857
  • CVE-2022-2858
  • CVE-2022-2853
  • CVE-2022-2856
  • CVE-2022-2859
  • CVE-2022-2860
  • CVE-2022-2861
Mitigations

The enterprise should deploy this patch as soon as the testing phase is completed.

Chrome Releases: Stable Channel Update for Desktop (googleblog.com)

References

Chrome Releases (googleblog.com)