CVE-2022-2164

MediumCVSS 6.3/10Last modified Jun 17, 2026

Description

Inappropriate implementation in Extensions API in Google Chrome prior to 103.0.5060.53 allowed an attacker who convinced a user to install a malicious extension to bypass discretionary access control via a crafted HTML page.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Affected software

Vendor	Product	Versions
Google	Chrome	>= unspecified, < 103.0.5060.53

References

https://chromereleases.googleblog.com/2022/06/stable-channel-update-for-desktop_21.htmlRelease Notes, Vendor Advisory
https://crbug.com/1268445Permissions Required, Vendor Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5BQRTR4SIUNIHLLPWTGYSDNQK7DYCRSB/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H2C4XOJVIILDXTOSMWJXHSQNEXFWSOD7/
https://security.gentoo.org/glsa/202208-25Third Party Advisory
https://chromereleases.googleblog.com/2022/06/stable-channel-update-for-desktop_21.htmlRelease Notes, Vendor Advisory
https://crbug.com/1268445Permissions Required, Vendor Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5BQRTR4SIUNIHLLPWTGYSDNQK7DYCRSB/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H2C4XOJVIILDXTOSMWJXHSQNEXFWSOD7/
https://security.gentoo.org/glsa/202208-25Third Party Advisory

Timeline

Published: Jul 28, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-216404.9Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.30 an CVE-2022-216414.9Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.29 an CVE-2022-216424.3Discourse is an open source platform for community discussion. In affected versions when composing a message from topic the composer user su CVE-2022-216439.8USOC is an open source CMS with a focus on simplicity. In affected versions USOC allows for SQL injection via register.php. In particular us CVE-2022-216447.2USOC is an open source CMS with a focus on simplicity. In affected versions USOC allows for SQL injection via usersearch.php. In search term CVE-2022-216468.1SpiceDB is a database system for managing security-critical application permissions. Any user making use of a wildcard relationship under th CVE-2022-216479.8CodeIgniter is an open source PHP full-stack web framework. Deserialization of Untrusted Data was found in the `old()` function in CodeIgnit CVE-2022-216486.1Latte is an open source template engine for PHP. Versions since 2.8.0 Latte has included a template sandbox and in affected versions it has CVE-2022-216495.4Convos is an open source multi-user chat that runs in a web browser. Characters starting with "https://" in the chat window create an <a> ta CVE-2022-21654.3Insufficient data validation in URL formatting in Google Chrome prior to 103.0.5060.53 allowed a remote attacker to perform domain spoofing CVE-2022-216505.4Convos is an open source multi-user chat that runs in a web browser. You can't use SVG extension in Convos' chat window, but you can upload CVE-2022-216516.1Shopware is an open source e-commerce software platform. An open redirect vulnerability has been discovered. Users may be arbitrary redirect