CVE-2022-0337

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Inappropriate implementation in File System API in Google Chrome on Windows prior to 97.0.4692.71 allowed a remote attacker to obtain potentially sensitive information via a crafted HTML page. (Chrome security severity: High)

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-668

Affected software

Vendor	Product	Versions
Google	Chrome	>= unspecified, < 97.0.4692.71

References

https://chromereleases.googleblog.com/2022/01/stable-channel-update-for-desktop.htmlRelease Notes, Vendor Advisory
https://crbug.com/1247389Exploit, Vendor Advisory
https://chromereleases.googleblog.com/2022/01/stable-channel-update-for-desktop.htmlRelease Notes, Vendor Advisory
https://crbug.com/1247389Exploit, Vendor Advisory

Timeline

Published: Jan 2, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-03384.3Insertion of Sensitive Information into Log File in Conda loguru prior to 0.5.3.CVE-2022-03399.8Server-Side Request Forgery (SSRF) in Pypi calibreweb prior to 0.6.16.CVE-2022-03415.4Cross-site Scripting (XSS) - Stored in GitHub repository vanessa219/vditor prior to 3.8.12.CVE-2022-03429.8An authentication bypass vulnerability in the CGI program of Zyxel USG/ZyWALL series firmware versions 4.20 through 4.70, USG FLEX series fi CVE-2022-03437.8A local attacker, as a different local user, may be able to send a HTTP request to 127.0.0.1:10000 after the user (typically a developer) ma CVE-2022-03444.3An issue has been discovered in GitLab affecting all versions starting from 10.0 before 14.5.4, all versions starting from 10.1 before 14.6.CVE-2022-03454.3The Customize WordPress Emails and Alerts WordPress plugin before 1.8.7 does not have authorisation and CSRF check in its bnfw_search_users CVE-2022-03466.1The XML Sitemap Generator for Google WordPress plugin before 2.0.4 does not validate a parameter which can be set to an arbitrary value, thu CVE-2022-03476.1The LoginPress | Custom Login Page Customizer WordPress plugin before 1.5.12 does not escape the redirect-page parameter before outputting i CVE-2022-03485.4Cross-site Scripting (XSS) - Stored in Packagist pimcore/pimcore prior to 10.2.CVE-2022-03499.8The NotificationX WordPress plugin before 2.3.9 does not sanitise and escape the nx_id parameter before using it in a SQL statement, leading CVE-2022-03505.4Cross-site Scripting (XSS) - Stored in GitHub repository vanessa219/vditor prior to 3.8.13.