CVE-2022-3312 - Insufficient validation of untrusted input in VPN in Google Chrome on ChromeOS prior to 106.0.5249.62 allowed a local attacker to bypass managed device restrictions via physical access to the device

Back Back to CVE browser

MEDIUM

Insufficient validation of untrusted input in VPN in Google Chrome on ChromeOS prior to 106.0.5249.62 allowed a local attacker to bypass managed device restrictions via physical access to the device

Published Nov 1, 2022

4.6

MEDIUM

CVSS 3.1

EPSS 0.24%

Description

Insufficient validation of untrusted input in VPN in Google Chrome on ChromeOS prior to 106.0.5249.62 allowed a local attacker to bypass managed device restrictions via physical access to the device. (Chromium security severity: Medium)

Affected products

Vendor Google Product Chrome Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  <106.0.5249.62

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Google

Chrome

n/a

Version	Status	Constraints
unspecified	affected	<106.0.5249.62

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-306

Missing Authentication

References (3)

https://chromereleases.googleblog.com/2022/09/stable-channel-update-for-desktop_27.html
Release NotesVendor Advisory
https://crbug.com/1303306
Permissions RequiredVendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-42702
Advisory

Link	Providers	Tags
https://chromereleases.googleblog.com/2022/09/stable-channel-update-for-desktop_27.html		Release NotesVendor Advisory
https://crbug.com/1303306		Permissions RequiredVendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-42702		Advisory