CVE-2022-1132

low-risk
Published 2022-07-23

Inappropriate implementation in Virtual Keyboard in Google Chrome on Chrome OS prior to 100.0.4896.60 allowed a local attacker to bypass navigation restrictions via physical access to the device.

Do I need to act?

-
0.05% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
6
CVSS 6.1/10 Medium
PHYSICAL / LOW complexity

Affected Products (1)

Affected Vendors

Google

References (6)

Release Notes https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop_...
Exploit https://crbug.com/1303410
Third Party Advisory https://security.gentoo.org/glsa/202208-25
Release Notes https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop_...
Exploit https://crbug.com/1303410
Third Party Advisory https://security.gentoo.org/glsa/202208-25
25
/ 100
low-risk
Severity 20/34 · Moderate
Exploitability 0/34 · Minimal
Exposure 5/34 · Minimal