CVE-2022-4452

highpriority · track · 35EPSS 0.004 · 32 %ileDEEURUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.38% (32nd) EPSS

CVSS 8.8 · high

Is it mine?

8 products

Check your exposure

Who says so?

6 sources

cnnvd · enisa_euvd · fstec_bdu · osv

EPSS · scored 2026-10-27

Insufficient data validation in crosvm in Google Chrome prior to 107.0.5304.62 allowed a remote attacker to potentially exploit object corruption via a crafted HTML page. (Chromium security severity: High)

cvss

Technical severity, 0–10. One row per scoring source.

8.8

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.18.8highCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 2.8 · impact 5.9

v3.18.8highAV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.18.1highCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-19USCWE-200US

affected products (8)

Products and version ranges known to be affected.

Google Android 11all versionscert_bundDEcpe:/o:google:android:11
Google Android 12all versionscert_bundDEcpe:/o:google:android:12
Google Android 12Lall versionscert_bundDEcpe:/o:google:android:12l
Google Android 13all versionscert_bundDEcpe:/o:google:android:13
Samsung Androidall versionscert_bundDEcpe:/o:samsung:android:-
Google Chrome107.0.5304.62 → 107.0.5304.62enisa_euvdEU
Google Inc Google Chrome≤ 107.0.5304.62fstec_bduRU
google chrome< 107.0.5304.62nvdUScpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*

advisories (2)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2023-0574Android Patchday März 2023Deutsch2023-03-06csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Google Android ausnutzen, um seine Privilegien zu erhöhen, vertrauliche Informationen offenzulegen, Code auszuführen und einen Denial-of-Service-Zustand zu verursachen.
ASB-A-2518023072023-03-01vendor · osvUS
In is_valid of queue.rs, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

also known as (5)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu osv cert_bund nvd NVD CVE.org MITRE

published 2023-08-25modified 2026-06-17

references (8)

External citations — patches, advisories, analysis.

https://bugs.chromium.org/p/chromium/issues/detail?id=1372457 cnnvd
https://crbug.com/1372457 cnnvd
https://cxsecurity.com/cveshow/CVE-2022-4452/cnnvd
https://www.auscert.org.au/bulletins/ESB-2023.1404 cnnvd
https://bugs.chromium.org/p/chromium/issues/detail?id=1372457 enisa_euvd
https://crbug.com/1372457 enisa_euvd
https://bugs.chromium.org/p/chromium/issues/detail?id=1372457Issue TrackingPatchPermissions RequiredVendor Advisorynvd
https://crbug.com/1372457Issue TrackingPatchPermissions RequiredVendor Advisorynvd

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan