CVE-2022-3660 — Improper Input Validation in Google Chrome

CWE-20 — Improper Input ValidationCWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer7 documents7 sources
Severity
4.3MEDIUMNVD
CISA7.8
EPSS
0.1%
top 70.15%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Google ChromeChromiumDebian Chromium+1 more
Timeline
PublishedNov 1
Latest updateFeb 26

Description

Inappropriate implementation in Full screen mode in Google Chrome on Android prior to 107.0.5304.62 allowed a remote attacker to hide the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Medium)

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages5 packages

▶CVEListV5google/chromeunspecified — 107.0.5304.62
▶NVDgoogle/chrome< 107.0.5304.62
▶debiandebian/chromium< chromium 107.0.5304.68-1 (bookworm)
▶Debianchromium/chromium< 107.0.5304.68-1~deb11u1+3

Patches

Patch: crbug.com ↗Patch: crbug.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-h38p-2234-q2gv: Inappropriate implementation in Full screen mode in Google Chrome on Android prior to 107↗2022-11-02
▶
OSV
CVE-2022-3660: Inappropriate implementation in Full screen mode in Google Chrome on Android prior to 107↗2022-11-01
▶

📋Vendor Advisories

4
Red Hat
kernel: rxrpc: fix a race in rxrpc_exit_net()↗2025-02-26
▶
Microsoft
Chromium: CVE-2022-3660 Inappropriate implementation in Full screen mode↗2022-10-11
▶
CISA
Microsoft Win32k Privilege Escalation Vulnerability↗2022-03-28
▶
Debian
CVE-2022-3660: chromium - Inappropriate implementation in Full screen mode in Google Chrome on Android pri...↗2022
▶