CVE-2022-4190 is a medium-severity vulnerability affecting Google Chrome versions prior to 108.0.5359.71, stemming from insufficient data validation in the Directory component. This flaw allows a remote attacker to bypass file system restrictions by enticing a user to visit a specially crafted HTML page. With a CVSS score of 8.8 (HIGH), successful exploitation could lead to high impact on confidentiality, integrity, and availability, requiring user interaction but no prior authentication. Currently, there is no evidence of active exploitation, nor are public exploit modules available in common frameworks like Metasploit or ExploitDB, with minimal community discussion and media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 108.0.5359.71CPE matchmatch criteria | cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.1 Security Researcher mentions.