CVE-2022-0108: Inappropriate implementation in Navigation
An inappropriate implementation flaw was found in the Navigation component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=1248444
External References:
https://chromereleases.googleblog.com/2022/01/stable-channel-update-for-desktop.html
Other sources
Inappropriate implementation in Navigation in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
WebKit. This issue was addressed with improved iframe sandbox enforcement.
— Apple
Credit
Affected Software
Remediation
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
- CVE-2023-32438
- CVE-2023-23499
- CVE-2023-23520
- CVE-2023-41990
- CVE-2023-23519
- CVE-2023-23500
- CVE-2023-23502
- CVE-2023-23504
- CVE-2023-23503
- CVE-2023-23512
- CVE-2023-23511
- CVE-2023-32393
- CVE-2022-0108
- CVE-2023-23496
- CVE-2023-23518
- CVE-2023-23517
- CVE-2023-23505
- CVE-2022-42915
- CVE-2022-42916
- CVE-2022-32221
- CVE-2022-35260
- CVE-2023-23539
- CVE-2023-23513
- CVE-2023-23493
- CVE-2023-23530
- CVE-2023-23531
- CVE-2023-23507
- CVE-2023-23516
- CVE-2023-23506
- CVE-2023-23498
- CVE-2023-28208
- CVE-2023-23497
- CVE-2023-23510
- CVE-2022-3705
- CVE-2023-23501
- CVE-2023-23508
- CVE-2022-0096
- CVE-2022-0097
- CVE-2022-0098
- CVE-2022-0099
- CVE-2022-0100
- CVE-2022-0101
- CVE-2022-0337
- CVE-2022-0102
- CVE-2022-0103
- CVE-2022-4924
- CVE-2022-0104
- CVE-2022-0105
- CVE-2022-0106
- CVE-2022-0107
- CVE-2022-0109
- CVE-2022-0110
- CVE-2022-0111
- CVE-2022-0112
- CVE-2022-0113
- CVE-2022-0114
- CVE-2022-0115
- CVE-2022-0116
- CVE-2022-0117
- CVE-2022-0118
- CVE-2022-0120
- CVE-2022-4925
- CVE-2023-23529
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2022-0108.
What is the title of the vulnerability?
The title of the vulnerability is WebKit.
What is the description of the vulnerability?
The vulnerability is related to inappropriate implementation in Navigation in Google Chrome prior to version 97.0.4692.71, allowing a remote attacker to leak cross-origin data via a crafted HTML page.
What software are affected by this vulnerability?
The following software are affected by this vulnerability: Apple Safari up to version 16.3, Ubuntu Chromium Browser up to version 97.0.4692.71-0ubuntu0.18.04.1, Ubuntu Webkit2gtk up to version 2.38.6-0ubuntu0.20.04.1, Ubuntu Webkit2gtk up to version 2.38.6-0ubuntu0.22.04.1, Ubuntu Webkit2gtk up to version 2.38.6-0ubuntu0.22.10.1, Ubuntu Webkit2gtk up to version 2.40.1-0ubuntu0.23.04.1, Debian Chromium up to version 90.0.4430.212-1~deb10u1, Debian Webkit2gtk up to version 2.36.4-1~deb10u1, Debian Webkit2gtk up to version 2.38.5-1~deb11u1, Debian Wpewebkit up to version 2.38.5-1~deb11u1, Apple watchOS up to version 9.3, Apple tvOS up to version 16.3, Apple macOS Ventura up to version 13.2, Apple iOS up to version 16.3, and Apple iPadOS up to version 16.3.
What is the severity of this vulnerability?
The severity of this vulnerability is not mentioned.
Is there a fix available for this vulnerability?
Yes, the fix for this vulnerability is available in Apple Safari version 16.3, Ubuntu Chromium Browser version 97.0.4692.71-0ubuntu0.18.04.1, Ubuntu Webkit2gtk version 2.38.6-0ubuntu0.20.04.1, Ubuntu Webkit2gtk version 2.38.6-0ubuntu0.22.04.1, Ubuntu Webkit2gtk version 2.38.6-0ubuntu0.22.10.1, Ubuntu Webkit2gtk version 2.40.1-0ubuntu0.23.04.1, Debian Chromium version 90.0.4430.212-1~deb10u1, Debian Webkit2gtk version 2.36.4-1~deb10u1, Debian Webkit2gtk version 2.38.5-1~deb11u1, Debian Wpewebkit version 2.38.5-1~deb11u1, Apple watchOS version 9.3, Apple tvOS version 16.3, Apple macOS Ventura version 13.2, Apple iOS version 16.3, and Apple iPadOS version 16.3.