CVE-2022-2856

CVE-2022-2856 is an insufficient input validation flaw (CWE-20) in the Intents component of Google Chrome on Android. A remote attacker can trigger it by convincing a user to open a crafted HTML page, requiring no privileges beyond user interaction. On success, the attacker can make the victim's browser arbitrarily browse to a malicious, attacker-chosen website, an integrity impact (CVSS 3.1: 6.5, AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N). It affects Chrome on Android prior to 104.0.5112.101, and Fedora's chromium packages were also affected per the CPE data. The flaw is being exploited in the wild: it was added to CISA's Known Exploited Vulnerabilities catalog on 2022-08-18, with headlines indicating it was the ninth actively exploited Chrome zero-day patched by Google in 2022.

What to do: Update Chrome on Android to 104.0.5112.101 or later (check via Chrome's About page or the Play Store) and apply the updated Fedora chromium packages as they are released, per the CISA KEV required action. Verify fleet versions for managed Android/Chrome deployments and confirm no devices remain below 104.0.5112.101. Until patched, treat links from untrusted sources with caution since exploitation requires user interaction with a crafted page.