CVE-2022-0466

CriticalCVSS 9.6/10Last modified Jun 17, 2026

Description

Inappropriate implementation in Extensions Platform in Google Chrome prior to 98.0.4758.80 allowed an attacker who convinced a user to install a malicious extension to potentially perform a sandbox escape via a crafted HTML page.

Metrics

CVSS 3.1 9.6/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
Google	Chrome	>= unspecified, < 98.0.4758.80

References

https://chromereleases.googleblog.com/2022/02/stable-channel-update-for-desktop.htmlRelease Notes, Vendor Advisory
https://crbug.com/1115460Patch, Vendor Advisory
https://chromereleases.googleblog.com/2022/02/stable-channel-update-for-desktop.htmlRelease Notes, Vendor Advisory
https://crbug.com/1115460Patch, Vendor Advisory

Timeline

Published: Apr 5, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-04678.8Inappropriate implementation in Pointer Lock in Google Chrome on Windows prior to 98.0.4758.80 allowed a remote attacker to bypass navigatio CVE-2022-04688.8Use after free in Payments in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to potentially exploit heap corruption via a cra CVE-2022-04698.8Use after free in Cast in Google Chrome prior to 98.0.4758.80 allowed a remote attacker who convinced a user to engage in specific interacti CVE-2022-04708.8Out of bounds memory access in V8 in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to potentially exploit heap corruption vi CVE-2022-04716.1The Favicon by RealFaviconGenerator WordPress plugin before 1.3.23 does not properly sanitise and escape the json_result_url parameter befor CVE-2022-04725.4Unrestricted Upload of File with Dangerous Type in Packagist jsdecena/laracom prior to v2.0.9.CVE-2022-04734.8OTRS administrators can configure dynamic field and inject malicious JavaScript code in the error message of the regular expression check. W CVE-2022-04743.5Full list of recipients from customer users in a contact field could be disclosed in notification emails event when the notification is set CVE-2022-04755.4Malicious translator is able to inject JavaScript code in few translatable strings (where HTML is allowed). The code could be executed in th CVE-2022-04765.5Denial of Service in GitHub repository radareorg/radare2 prior to 5.6.4.CVE-2022-04774.9An issue has been discovered in GitLab affecting all versions starting from 11.9 before 14.5.4, all versions starting from 14.6.0 before 14.CVE-2022-04788.8The Event Manager and Tickets Selling for WooCommerce WordPress plugin before 3.5.8 does not validate and escape the post_author_gutenberg p