6.5

CVE-2022-2856: Google Chromium Intents Insufficient Input Validation Vulnerability

CVSS: 6.5v3.1MediumKEVAnalyzed
AliasesUBUNTU-CVE-2022-2856DEBIAN-CVE-2022-2856
Published 26-09-2022Last modified 21-10-2025
Open JSON

Vulnerability summary

CVE-2022-2856 is a medium (CVSS 6.5) Improper Input Validation vulnerability in Google Chromium Intents. It is known to be exploited: CISA lists it, first on 18-08-2022. EPSS estimates a 4.56% chance of exploitation in the next 30 days, higher than 91.4% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk
85/100
0100
Critical · default modelHow is this calculated?
CVSS score
6.5/10
010
Medium · v3.1 (CVE.org)
EPSS score
4.56%
0%100%
Low · +0.03 pp in 30 days
KEVListedCISA
RansomwareNone recordedNo known use recorded
Public exploits1reference

Advisory lineage

Upstream 0 · Downstream 7 · Related 5
DSA-5212-1MGASA-2022-0307OPENSUSE-SU-2022:10099-1OPENSUSE-SU-2022:10108-1OPENSUSE-SU-2022:10109-1OPENSUSE-SU-2024:12277-1

Timeline

  1. 18-08-2022
    Added to CISA KEVGoogle Chromium Intents Insufficient Input Validation Vulnerability
  2. 08-09-2022
    CISA remediation dueApply updates per vendor instructions.
  3. 26-09-2022
    PublishedVulnerability first disclosed.
  4. 21-10-2025
    Last modifiedVulnerability information updated.

Description

Insufficient validation of untrusted input in Intents in Google Chrome on Android prior to 104.0.5112.101 allowed a remote attacker to arbitrarily browse to a malicious website via a crafted HTML page.

CVSS metrics

4 scores · 4 sources · 1 version

EPSS trend

Probability

4.56%

Chance of exploitation in the next 30 days

Percentile

91%

Versus all other CVEs

30-day change

+0.03 pp

From 4.53% on 18-09-2026

18-09-202618-10-2026
EPSS score
4.56%

Known exploited

Compare KEV catalogs
CISA KEVListed
Added
18-08-2022
Federal due date
08-09-2022

CISA required action

Apply updates per vendor instructions. chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop_16.html nvd.nist.gov/vuln/detail/CVE-2022-2856

Public exploits

1 found
  • referenceUnverified

    Exploit Reference (crbug.com)

    Maturity: unknown

Weaknesses

CWE · root cause

Affected systems

Debian1 product
  • chromium< 104.0.5112.101-1
Fedoraproject1 product
Google1 product
  • chrome≥ unspecified, < 104.0.5112.101 | < 104.0.5112.101 | < 104.0.5112.102
Ubuntu1 product
  • chromium-browser< 104.0.5112.101-0ubuntu0.18.04.1

4 vendors · 4 products

References

8 links