On Wednesday, August 17, 2022, Google patched its fifth zero-day vulnerability found in Chrome this year. The actively exploited vulnerability is one of several vulnerability fixes released this week.
High-scoring CVE-2022-2856
Per an advisory shared by Google, the critical bug CVE-2022-2856 was linked to “insufficient validation of untrusted input in Intents” that allows arbitrary code execution when exploited. The advisory also brought to light ten other patches for different Chrome issues.
The vulnerability exists within Chrome Intents. Intents is an Android-specific linking replacement for URI schemes that helps to handle logic to open mobile apps with a link or open the Play Store to prompt an install of the linked app.
Insufficient or improper input validation is a common weakness in web applications. Input validation is a method of assessing information to make sure it’s safe to process within the code.
When software doesn’t correctly validate input, attackers can use the weakness to craft malicious inputs that may lead to arbitrary code execution or system takeover.
Recommended remediation
You can always fix vulnerabilities fast with Automox by using a “patch all” policy for every OS in your environment (which will also patch every third-party software we support).
'Patch all' policies guarantee you fix vulnerabilities fast in the most common and highest risk applications. Use the device targeting feature to customize your policies so they are highly effective.
We recommend you set up these policies on a recurring schedule to capture future patches as well – doing so will help you deploy new updates as soon as they’re available. If you haven’t already, you can automate Chrome patching here.
5 Chrome vulnerabilities in 2022 alone
As mentioned, this is the fifth zero-day Google has patched in Chrome under active attack this year. Here are the four others:
February witnessed CVE-2022-0609, the first Chrome zero-day of the year. The vulnerability came from a use-after-free flaw in Chrome’s Animation component. Later, word spread that North Korean attackers exploited the vulnerability several weeks before it was even noticed or remediated.
The following month CVE-2022-1096 surfaced. Though quickly patched, it presented another type-confusion issue in V8.
In April, Google patched CVE-2022-1364 – a type confusion flaw affecting Chrome’s use of the V8 JavaScript engine on which attackers already had pounced.
Then in May, CVE-2022-2294 presented itself as a buffer overflow flaw Google had to patch. And last month, Google patched an actively exploited heap buffer overflow flaw in WebRTC, also tracked as CVE-2022-2294.
Automox for Easy IT Operations
Automox is the cloud-native IT operations platform for modern organizations. It makes it easy to keep every endpoint automatically configured, patched, and secured – anywhere in the world. With the push of a button, IT admins can fix critical vulnerabilities faster, slash cost and complexity, and win back hours in their day.
Grab your free trial of Automox and join thousands of companies transforming IT operations into a strategic business driver.
