CVE-2022-0337
Inappropriate implementation in File System API in Google Chrome on Windows prior to 97.0.4692.71...
Inappropriate implementation in File System API in Google Chrome on Windows prior to 97.0.4692.71 allowed a remote attacker to obtain potentially sensitive information via a crafted HTML page. (Chrome security severity: High)
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
6.5
Inappropriate implementation in File System API in Google Chrome on Windows prior to 97.0.4692.71 allowed a remote attacker to obtain potentially sensitive information via a crafted HTML page. (Chrome security severity: High)
- Record
CVE-2022-0337- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N - Weakness
- CWE-668
- Updated
- 2026-11-02
CVE List No score
Inappropriate implementation in File System API in Google Chrome on Windows prior to 97.0.4692.71 allowed a remote attacker to obtain potentially sensitive information via a crafted HTML page. (Chrome security severity: High)
- Record
CVE-2022-0337- Updated
- 2026-11-02
EUVDEUVD-2022-15500 No score
Inappropriate implementation in File System API in Google Chrome on Windows prior to 97.0.4692.71 allowed a remote attacker to obtain potentially sensitive information via a crafted HTML page. (Chrome security severity: High)
- Record
EUVD-2022-15500- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-crcf-r254-j6xv
6.5
Inappropriate implementation in File System API in Google Chrome on Windows prior to 97.0.4692.71...
Inappropriate implementation in File System API in Google Chrome on Windows prior to 97.0.4692.71 allowed a remote attacker to obtain potentially sensitive information via a crafted HTML page. (Chrome security severity: High)
- Record
GHSA-crcf-r254-j6xv- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N - Weakness
- CWE-668
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2022-0337
6.5
Inappropriate implementation in File System API in Google Chrome on Windows prior to 97.0.4692.71 allowed a remote attacker to obtain potentially sensitive information via a crafted HTML page. (Chrome security severity: High)
- Record
UBUNTU-CVE-2022-0337- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVMGASA-2022-0043 No score
Updated chromium-browser-stable packages fix security vulnerability
CVE-2022-0096: Use after free in Storage. CVE-2022-0097: Inappropriate implementation in DevTools. CVE-2022-0098: Use after free in Screen Capture. CVE-2022-0099: Use after free in Sign-in. CVE-2022-0100: Heap buffer overflow in Media streams API. CVE-2022-0101: Heap buffer overflow in Bookmarks. CVE-2022-0102: Type Confusion in V8. CVE-2022-0103: Use after free in SwiftShader. CVE-2022-0104: Heap buffer overflow in ANGLE. CVE-2022-0105: Use after free in PDF. CVE-2022-0106: Use after free in Autofill. CVE-2022-0107: Use after free in File Manager API. CVE-2022-0108: Inappropriate implementation in Navigation. CVE-2022-0109: Inappropriate implementation in Autofill. CVE-2022-0110: Incorrect security UI in Autofill. CVE-2022-0111: Inappropriate implementation in Navigation. CVE-2022-0112: Incorrect security UI in Browser UI. CVE-2022-0113: Inappropriate implementation in Blink. CVE-2022-0114: Out of bounds memory access in Web Serial. CVE-2022-0115: Uninitialized Use in File API. CVE-2022-0116: Inappropriate implementation in Compositing. CVE-2022-0117: Policy bypass in Service Workers. CVE-2022-0118: Inappropriate implementation in WebShare. CVE-2022-0120: Inappropriate implementation in Passwords. CVE-2022-0289: Use after free in Safe browsing. CVE-2022-0290: Use after free in Site isolation. CVE-2022-0291: Inappropriate implementation in Storage. CVE-2022-0292: Inappropriate implementation in Fenced Frames. CVE-2022-0293: Use after free in Web packaging. CVE-2022-0294: Inappropriate implementation in Push messaging. CVE-2022-0295: Use after free in Omnibox. CVE-2022-0296: Use after free in Printing. CVE-2022-0297: Use after free in Vulkan. CVE-2022-0298: Use after free in Scheduling. CVE-2022-0300: Use after free in Text Input Method Editor. CVE-2022-0301: Heap buffer overflow in DevTools. CVE-2022-0302: Use after free in Omnibox. CVE-2022-0304: Use after free in Bookmarks. CVE-2022-0305: Inappropriate implementation in Service Worker API. CVE-2022-0306: Heap buffer overflow in PDFium. CVE-2022-0307: Use after free in Optimization Guide. CVE-2022-0308: Use after free in Data Transfer. CVE-2022-0309: Inappropriate implementation in Autofill. CVE-2022-0310: Heap buffer overflow in Task Manager. CVE-2022-0311: Heap buffer overflow in Task Manager. CVE-2022-0337: Inappropriate implementation in File System API.
- Record
MGASA-2022-0043- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
chromium-browser-stableMageia:8 From an advisory covering 46 CVEs |
before 97.0.4692.99-1.mga8 | 97.0.4692.99-1.mga8 |
chromium-browserUbuntu:18.04:LTS |
before 97.0.4692.71-0ubuntu0.18.04.1, plus listed versions 61.0.3163.100-0ubuntu1.137862.0.3202.62-0ubuntu0.17.10.138062.0.3202.89-0ubuntu1.138662.0.3202.94-0ubuntu1.138863.0.3239.84-0ubuntu1 Show 45 moreShow less63.0.3239.108-0ubuntu164.0.3282.119-0ubuntu164.0.3282.140-0ubuntu164.0.3282.167-0ubuntu165.0.3325.146-0ubuntu165.0.3325.181-0ubuntu166.0.3359.139-0ubuntu0.18.04.366.0.3359.181-0ubuntu0.18.04.167.0.3396.99-0ubuntu0.18.04.168.0.3440.75-0ubuntu0.18.04.168.0.3440.106-0ubuntu0.18.04.169.0.3497.81-0ubuntu0.18.04.170.0.3538.67-0ubuntu0.18.04.170.0.3538.77-0ubuntu0.18.04.170.0.3538.110-0ubuntu0.18.04.171.0.3578.80-0ubuntu0.18.04.171.0.3578.98-0ubuntu0.18.04.172.0.3626.119-0ubuntu0.18.04.172.0.3626.121-0ubuntu0.18.04.173.0.3683.75-0ubuntu0.18.04.173.0.3683.86-0ubuntu0.18.04.174.0.3729.169-0ubuntu0.18.04.175.0.3770.90-0ubuntu0.18.04.175.0.3770.142-0ubuntu0.18.04.176.0.3809.87-0ubuntu0.18.04.176.0.3809.100-0ubuntu0.18.04.177.0.3865.90-0ubuntu0.18.04.178.0.3904.70-0ubuntu0.18.04.278.0.3904.97-0ubuntu0.18.04.178.0.3904.108-0ubuntu0.18.04.179.0.3945.79-0ubuntu0.18.04.179.0.3945.130-0ubuntu0.18.04.180.0.3987.87-0ubuntu0.18.04.180.0.3987.149-0ubuntu0.18.04.180.0.3987.163-0ubuntu0.18.04.181.0.4044.122-0ubuntu0.18.04.181.0.4044.138-0ubuntu0.18.04.183.0.4103.61-0ubuntu0.18.04.184.0.4147.105-0ubuntu0.18.04.185.0.4183.83-0ubuntu0.18.04.285.0.4183.121-0ubuntu0.18.04.186.0.4240.75-0ubuntu0.18.04.186.0.4240.198-0ubuntu0.18.04.187.0.4280.66-0ubuntu0.18.04.189.0.4389.82-0ubuntu0.18.04.1 |
97.0.4692.71-0ubuntu0.18.04.1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | Puliczek/CVE-2022-0337-PoC-Google-Chrome-Microsoft-Edge-Opera | 2022-03-19 |
| PoC in GitHub | maldev866/ChExp-CVE-2022-0337- | 2023-03-01 |
| PoC in GitHub | zer0ne1/CVE-2022-0337-RePoC | 2023-11-21 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-0337 is a medium vulnerability (CVSS 6.5) in Google Chrome, published February 2, 2022. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 1.39%, the 72nd percentile. Fixed in chromium-browser 97.0.4692.71-0ubuntu0.18.04.1.
References
chromereleases.googleblog.com/2022/01/stable-channel-update-for-desktop.html
crbug.com/1247389
nvd.nist.gov/vuln/detail/CVE-2022-0337
github.com/advisories/GHSA-crcf-r254-j6xv
advisories.mageia.org/MGASA-2022-0043.html
bugs.mageia.org/show_bug.cgi?id=29846
chromereleases.googleblog.com/2022/01/stable-channel-update-for-desktop_19.html
ubuntu.com/security/CVE-2022-0337
cve.org/CVERecord?id=CVE-2022-0337
Left out here: 10 versions. The JSON record has them.