CVE-2022-2615

Insufficient policy enforcement in Cookies in Google Chrome prior to 104.0.5112.79 allowed a remote attacker to leak cross-origin data via a crafted HTML page.

Weakness

The product relies on the existence or values of cookies when performing security-critical operations, but it does not properly ensure that the setting is valid for the associated user.

Affected Software

Potential Mitigations

Related Attack Patterns

• https://cwe.mitre.org/data/definitions/226.html
• https://cwe.mitre.org/data/definitions/31.html
• https://cwe.mitre.org/data/definitions/39.html

References

• https://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop.html
• https://crbug.com/1268580
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4NMJURTG5RO3TGD7ZMIQ6Z4ZZ3SAVYE/
• https://security.gentoo.org/glsa/202208-35
• https://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop.html
• https://crbug.com/1268580
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4NMJURTG5RO3TGD7ZMIQ6Z4ZZ3SAVYE/
• https://security.gentoo.org/glsa/202208-35