Every CVE Search/ Get API key

CVE-2022-2619

Insufficient validation of untrusted input in Settings in Google Chrome prior to 104.0.5112.79...

4.3 MediumFix available

Insufficient validation of untrusted input in Settings in Google Chrome prior to 104.0.5112.79 allowed an attacker who convinced a user to install a malicious extension to inject scripts or HTML into a privileged page via a crafted HTML page.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
None
Integrity
Low
Availability
None

Exploit likelihood

0.45%Down 0.4 points since Aug 13, 2022
90%50%10%1%

What each source reports

NVD Score used 4.3

Insufficient validation of untrusted input in Settings in Google Chrome prior to 104.0.5112.79 allowed an attacker who convinced a user to install a malicious extension to inject scripts or HTML into a privileged page via a crafted HTML page.

Record
CVE-2022-2619
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Weakness
CWE-116
Updated
2026-11-02
CVE List No score

Insufficient validation of untrusted input in Settings in Google Chrome prior to 104.0.5112.79 allowed an attacker who convinced a user to install a malicious extension to inject scripts or HTML into a privileged page via a crafted HTML page.

Record
CVE-2022-2619
Updated
2026-11-02
EUVDEUVD-2022-34866 No score

Insufficient validation of untrusted input in Settings in Google Chrome prior to 104.0.5112.79 allowed an attacker who convinced a user to install a malicious extension to inject scripts or HTML into a privileged page via a crafted HTML page.

Record
EUVD-2022-34866
Updated
2026-11-03
GitHub AdvisoriesGHSA-7jm8-q7ph-7v6r 4.3

Insufficient validation of untrusted input in Settings in Google Chrome prior to 104.0.5112.79...

Insufficient validation of untrusted input in Settings in Google Chrome prior to 104.0.5112.79 allowed an attacker who convinced a user to install a malicious extension to inject scripts or HTML into a privileged page via a crafted HTML page.

Record
GHSA-7jm8-q7ph-7v6r
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Weakness
CWE-20
Updated
2026-11-02
OSV 4.3

Insufficient validation of untrusted input in Settings in Google Chrome prior to 104.0.5112.79 allowed an attacker who convinced a user to install a malicious extension to inject scripts or HTML into a privileged page via a crafted HTML page.

Record
CVE-2022-2619
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Updated
2026-11-02
OSVDEBIAN-CVE-2022-2619 4.3

Insufficient validation of untrusted input in Settings in Google Chrome prior to 104.0.5112.79 allowed an attacker who convinced a user to install a malicious extension to inject scripts or HTML into a privileged page via a crafted HTML page.

Record
DEBIAN-CVE-2022-2619
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Updated
2026-11-03
Show 6 moreShow less
OSVUBUNTU-CVE-2022-2619 4.3

Insufficient validation of untrusted input in Settings in Google Chrome prior to 104.0.5112.79 allowed an attacker who convinced a user to install a malicious extension to inject scripts or HTML into a privileged page via a crafted HTML page.

Record
UBUNTU-CVE-2022-2619
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Updated
2026-11-02
OSVMGASA-2022-0277 No score

Updated chromium-browser-stable packages fix security vulnerability

[1325699] High CVE-2022-2603: Use after free in Omnibox. Reported by Anonymous on 2022-05-16 [1335316] High CVE-2022-2604: Use after free in Safe Browsing. Reported by Nan Wang(@eternalsakura13) and Guang Gong of 360 Alpha Lab on 2022-06-10 [1338470] High CVE-2022-2605: Out of bounds read in Dawn. Reported by Looben Yang on 2022-06-22 [1330489] High CVE-2022-2606: Use after free in Managed devices API. Reported by Nan Wang(@eternalsakura13) and Guang Gong of 360 Alpha Lab on 2022-05-31 [1286203] High CVE-2022-2607: Use after free in Tab Strip. Reported by @ginggilBesel on 2022-01-11 [1330775] High CVE-2022-2608: Use after free in Overview Mode. Reported by Khalil Zhani on 2022-06-01 [1338560] High CVE-2022-2609: Use after free in Nearby Share. Reported by koocola(@alo_cook) and Guang Gong of 360 Vulnerability Research Institute on 2022-06-22 [1278255] Medium CVE-2022-2610: Insufficient policy enforcement in Background Fetch. Reported by Maurice Dauer on 2021-12-09 [1320538] Medium CVE-2022-2611: Inappropriate implementation in Fullscreen API. Reported by Irvan Kurniawan (sourc7) on 2022-04-28 [1321350] Medium CVE-2022-2612: Side-channel information leakage in Keyboard input. Reported by Erik Kraft ([email protected]), Martin Schwarzl ([email protected]) on 2022-04-30 [1325256] Medium CVE-2022-2613: Use after free in Input. Reported by Piotr Tworek (Vewd) on 2022-05-13 [1341907] Medium CVE-2022-2614: Use after free in Sign-In Flow. Reported by raven at KunLun lab on 2022-07-05 [1268580] Medium CVE-2022-2615: Insufficient policy enforcement in Cookies. Reported by Maurice Dauer on 2021-11-10 [1302159] Medium CVE-2022-2616: Inappropriate implementation in Extensions API. Reported by Alesandro Ortiz on 2022-03-02 [1292451] Medium CVE-2022-2617: Use after free in Extensions API. Reported by @ginggilBesel on 2022-01-31 [1308422] Medium CVE-2022-2618: Insufficient validation of untrusted input in Internals. Reported by asnine on 2022-03-21 [1332881] Medium CVE-2022-2619: Insufficient validation of untrusted input in Settings. Reported by Oliver Dunk on 2022-06-04 [1337304] Medium CVE-2022-2620: Use after free in WebUI. Reported by Nan Wang(@eternalsakura13) and Guang Gong of 360 Alpha Lab on 2022-06-17 [1323449] Medium CVE-2022-2621: Use after free in Extensions. Reported by Huyna at Viettel Cyber Security on 2022-05-07 [1332392] Medium CVE-2022-2622: Insufficient validation of untrusted input in Safe Browsing. Reported by Imre Rad (@ImreRad) and @j00sean on 2022-06-03 [1337798] Medium CVE-2022-2623: Use after free in Offline. Reported by raven at KunLun lab on 2022-06-20 [1339745] Medium CVE-2022-2624: Heap buffer overflow in PDF. Reported by YU-CHANG CHEN and CHIH-YEN CHANG, working with DEVCORE Internship Program on 2022-06-27 [1251653] Various fixes from internal audits, fuzzing and other initiatives

Record
MGASA-2022-0277
Updated
2026-11-02
OSVopenSUSE-SU-2022:10086-1 No score

Security update for chromium

This update for chromium fixes the following issues:

Chromium 104.0.5112.79 (boo#1202075)

  • CVE-2022-2603: Use after free in Omnibox
  • CVE-2022-2604: Use after free in Safe Browsing
  • CVE-2022-2605: Out of bounds read in Dawn
  • CVE-2022-2606: Use after free in Managed devices API
  • CVE-2022-2607: Use after free in Tab Strip
  • CVE-2022-2608: Use after free in Overview Mode
  • CVE-2022-2609: Use after free in Nearby Share
  • CVE-2022-2610: Insufficient policy enforcement in Background Fetch
  • CVE-2022-2611: Inappropriate implementation in Fullscreen API
  • CVE-2022-2612: Side-channel information leakage in Keyboard input
  • CVE-2022-2613: Use after free in Input
  • CVE-2022-2614: Use after free in Sign-In Flow
  • CVE-2022-2615: Insufficient policy enforcement in Cookies
  • CVE-2022-2616: Inappropriate implementation in Extensions API
  • CVE-2022-2617: Use after free in Extensions API
  • CVE-2022-2618: Insufficient validation of untrusted input in Internals
  • CVE-2022-2619: Insufficient validation of untrusted input in Settings
  • CVE-2022-2620: Use after free in WebUI
  • CVE-2022-2621: Use after free in Extensions
  • CVE-2022-2622: Insufficient validation of untrusted input in Safe Browsing
  • CVE-2022-2623: Use after free in Offline
  • CVE-2022-2624: Heap buffer overflow in PDF
  • Switch back to Clang so that we can use BTI on aarch64
    • Gold is too old - doesn't understand BTI
    • LD crashes on aarch64
  • Re-enable LTO
  • Prepare move to FFmpeg 5 for new channel layout (requires 5.1+)
Record
openSUSE-SU-2022:10086-1
Updated
2026-11-02
OSVopenSUSE-SU-2022:10092-1 No score

Security update for chromium

This update for chromium fixes the following issues:

Chromium 104.0.5112.79 (boo#1202075)

  • CVE-2022-2603: Use after free in Omnibox
  • CVE-2022-2604: Use after free in Safe Browsing
  • CVE-2022-2605: Out of bounds read in Dawn
  • CVE-2022-2606: Use after free in Managed devices API
  • CVE-2022-2607: Use after free in Tab Strip
  • CVE-2022-2608: Use after free in Overview Mode
  • CVE-2022-2609: Use after free in Nearby Share
  • CVE-2022-2610: Insufficient policy enforcement in Background Fetch
  • CVE-2022-2611: Inappropriate implementation in Fullscreen API
  • CVE-2022-2612: Side-channel information leakage in Keyboard input
  • CVE-2022-2613: Use after free in Input
  • CVE-2022-2614: Use after free in Sign-In Flow
  • CVE-2022-2615: Insufficient policy enforcement in Cookies
  • CVE-2022-2616: Inappropriate implementation in Extensions API
  • CVE-2022-2617: Use after free in Extensions API
  • CVE-2022-2618: Insufficient validation of untrusted input in Internals
  • CVE-2022-2619: Insufficient validation of untrusted input in Settings
  • CVE-2022-2620: Use after free in WebUI
  • CVE-2022-2621: Use after free in Extensions
  • CVE-2022-2622: Insufficient validation of untrusted input in Safe Browsing
  • CVE-2022-2623: Use after free in Offline
  • CVE-2022-2624: Heap buffer overflow in PDF
  • Switch back to Clang so that we can use BTI on aarch64
    • Gold is too old - doesn't understand BTI
    • LD crashes on aarch64
  • Re-enable LTO
  • Prepare move to FFmpeg 5 for new channel layout (requires 5.1+)
Record
openSUSE-SU-2022:10092-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:12251-1 No score

chromedriver-104.0.5112.79-1.1 on GA media

These are all security issues fixed in the chromedriver-104.0.5112.79-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:12251-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:12948-1 No score

ungoogled-chromium-113.0.5672.92-1.1 on GA media

These are all security issues fixed in the ungoogled-chromium-113.0.5672.92-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:12948-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
chromium
Debian:12
 before 104.0.5112.79-1
104.0.5112.79-1
chromium
Debian:13
 before 104.0.5112.79-1
104.0.5112.79-1
chromium
Debian:14
 before 104.0.5112.79-1
104.0.5112.79-1
chromium
Debian:11
From an advisory covering 25 CVEs
 before 104.0.5112.79-1~deb11u1, plus listed versions
100.0.4896.127-1100.0.4896.127-1~deb11u1100.0.4896.60-1100.0.4896.60-1~deb11u1100.0.4896.75-1
Show 38 moreShow less
100.0.4896.75-1~deb11u1100.0.4896.88-1100.0.4896.88-1~deb11u1101.0.4951.41-1101.0.4951.41-1~deb11u1101.0.4951.41-2101.0.4951.54-1101.0.4951.64-1101.0.4951.64-1~deb11u1102.0.5005.115-1102.0.5005.115-1~deb11u1102.0.5005.61-1102.0.5005.61-1~deb11u1103.0.5060.114-1103.0.5060.114-1~deb11u1103.0.5060.134-1103.0.5060.134-1~deb11u1103.0.5060.53-1103.0.5060.53-1~deb11u190.0.4430.212-193.0.4577.82-197.0.4692.71-0.197.0.4692.71-0.1~deb11u197.0.4692.99-197.0.4692.99-1~deb11u197.0.4692.99-1~deb11u298.0.4758.102-198.0.4758.102-1~deb11u198.0.4758.80-198.0.4758.80-1~deb11u199.0.4818.0-0.199.0.4844.51-199.0.4844.51-1~deb11u199.0.4844.51-299.0.4844.74-199.0.4844.74-1~deb11u199.0.4844.84-199.0.4844.84-1~deb11u1
104.0.5112.79-1~deb11u1
chromium-browser-stable
Mageia:8
From an advisory covering 22 CVEs
 before 104.0.5112.79-1.mga8
104.0.5112.79-1.mga8
chromium-browser
Ubuntu:18.04:LTS
 before 104.0.5112.101-0ubuntu0.18.04.1, plus listed versions
61.0.3163.100-0ubuntu1.137862.0.3202.62-0ubuntu0.17.10.138062.0.3202.89-0ubuntu1.138662.0.3202.94-0ubuntu1.138863.0.3239.84-0ubuntu1
Show 45 moreShow less
63.0.3239.108-0ubuntu164.0.3282.119-0ubuntu164.0.3282.140-0ubuntu164.0.3282.167-0ubuntu165.0.3325.146-0ubuntu165.0.3325.181-0ubuntu166.0.3359.139-0ubuntu0.18.04.366.0.3359.181-0ubuntu0.18.04.167.0.3396.99-0ubuntu0.18.04.168.0.3440.75-0ubuntu0.18.04.168.0.3440.106-0ubuntu0.18.04.169.0.3497.81-0ubuntu0.18.04.170.0.3538.67-0ubuntu0.18.04.170.0.3538.77-0ubuntu0.18.04.170.0.3538.110-0ubuntu0.18.04.171.0.3578.80-0ubuntu0.18.04.171.0.3578.98-0ubuntu0.18.04.172.0.3626.119-0ubuntu0.18.04.172.0.3626.121-0ubuntu0.18.04.173.0.3683.75-0ubuntu0.18.04.173.0.3683.86-0ubuntu0.18.04.174.0.3729.169-0ubuntu0.18.04.175.0.3770.90-0ubuntu0.18.04.175.0.3770.142-0ubuntu0.18.04.176.0.3809.87-0ubuntu0.18.04.176.0.3809.100-0ubuntu0.18.04.177.0.3865.90-0ubuntu0.18.04.178.0.3904.70-0ubuntu0.18.04.278.0.3904.97-0ubuntu0.18.04.178.0.3904.108-0ubuntu0.18.04.179.0.3945.79-0ubuntu0.18.04.179.0.3945.130-0ubuntu0.18.04.180.0.3987.87-0ubuntu0.18.04.180.0.3987.149-0ubuntu0.18.04.180.0.3987.163-0ubuntu0.18.04.181.0.4044.122-0ubuntu0.18.04.181.0.4044.138-0ubuntu0.18.04.183.0.4103.61-0ubuntu0.18.04.184.0.4147.105-0ubuntu0.18.04.185.0.4183.83-0ubuntu0.18.04.285.0.4183.121-0ubuntu0.18.04.186.0.4240.75-0ubuntu0.18.04.186.0.4240.198-0ubuntu0.18.04.187.0.4280.66-0ubuntu0.18.04.189.0.4389.82-0ubuntu0.18.04.1
104.0.5112.101-0ubuntu0.18.04.1
chromium
SUSE:Package Hub 15 SP4
From an advisory covering 22 CVEs
 before 104.0.5112.79-bp154.2.20.1
104.0.5112.79-bp154.2.20.1
chromium
openSUSE:Leap 15.4
From an advisory covering 22 CVEs
 before 104.0.5112.79-bp154.2.20.1
104.0.5112.79-bp154.2.20.1
chromium
SUSE:Package Hub 15 SP3
From an advisory covering 22 CVEs
 before 104.0.5112.79-bp153.2.113.1
104.0.5112.79-bp153.2.113.1
chromium
openSUSE:Leap 15.3
From an advisory covering 22 CVEs
 before 104.0.5112.79-bp153.2.113.1
104.0.5112.79-bp153.2.113.1
chromium
openSUSE:Tumbleweed
From an advisory covering 22 CVEs
 before 104.0.5112.79-1.1
104.0.5112.79-1.1
chromium
openSUSE:Tumbleweed
From an advisory covering 2310 CVEs
 before 113.0.5672.92-1.1
113.0.5672.92-1.1

History

History
RecordedChangedSources
affected, factsOSV
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-2619 is a medium vulnerability (CVSS 4.3) in Google Chrome, published August 5, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.45%, the 39th percentile. Fixed in chromium 104.0.5112.79-1.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 16 versions and 2,126 references. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open