CVE DatabaseCVE-2022-2856

Updated 2026-06-17한국어 권고문 →

CVE-2022-28566.5/MEDIUMCISA KEVCWE-20

Google Chrome on Android Intent Input Validation Vulnerability (CVE-2022-2856) Analysis and Mitigation Guide

⚡ Jump to Patch

Affected Vendors

google

Affected Components

chrome

Published Date

2022-09-26

CVSS v3.1

6.5

MEDIUM

EPSS (30d)

4.6%

FIRST.org

CISA KEV

Exploited

NVD Source ↗

Executive & SecOps Summary

SECOPS ASSESSMENT

Affected Scope

Google Chrome on Android prior to version 104.0.5112.101

Impact

Remote attackers can force arbitrary browsing to malicious websites via crafted HTML pages exploiting insufficient Intent validation

Mitigation

Immediately update Google Chrome on Android to version 104.0.5112.101 or later

Affected Products & Version Scope

Google Chrome on Android prior to version 104.0.5112.101

Remediation & Live Workaround Commands

PATCH & WORKAROUND

1. Official Patch & Version Upgrade Commands

Users must update Google Chrome via the Google Play Store. In enterprise environments managing devices via MDM/EMM, administrators can use the following ADB commands to audit and force updates:

bash

# Check the installed Chrome version on the connected Android device
adb shell dumpsys package com.android.chrome | grep versionName

# Force open the Google Play Store page for Chrome to trigger an update
adb shell am start -a android.intent.action.VIEW -d 'market://details?id=com.android.chrome'

2. Temporary Workaround & Hardening Configuration

If immediate patching is not feasible, restrict untrusted external protocol launches using Chrome Enterprise Policies to block unauthorized Intent schemes:

json

{
  "ExternalProtocolDialogShowAlwaysAllowed": false,
  "URLBlocklist": [
    "intent://*"
  ]
}

3. Log Audit & IoC Verification Commands

To detect potential exploitation attempts or suspicious Intent launches, administrators can monitor Android system logs using ADB Logcat:

bash

# Monitor real-time Intent and ActivityManager logs related to Chrome
adb logcat | grep -E 'Intent|ActivityManager|com.android.chrome'

Interactive SecOps Remediation Checklist

0/4 (0%)

Recommended Security Control & Mitigation Partner

SentinelOne Singularity AI EDR

Due to active in-the-wild exploitation, immediately upgrade Google Chrome on Android to version 104.0.5112.101 or higher.

Block Kernel Privilege Escalation & Ransomware Payloads Before You Can Reboot

Protect unpatched Windows, Linux, and macOS workloads against in-memory exploitation and lateral movement with autonomous EDR.

100% MITRE ATT&CK Detection · 1-Click Rollback

See Autonomous Endpoint Protection in Action

Technical Root Cause & Exploitation Mechanics

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2022-2856) is an input validation flaw (CWE-20) within the Intent handling mechanism of Google Chrome on Android. Chrome on Android supports the 'intent://' URI scheme to launch external applications or trigger specific actions from web pages. However, due to insufficient validation of untrusted input within these Intents, malicious parameters can bypass security checks and execute unintended actions.

2. Exploitation Mechanics & Attack Scenario

An attacker can host a specially crafted HTML page containing malicious Intent links or scripts. When a victim visits this page, Chrome parses and executes the Intent without proper validation or explicit user consent. The attacker can manipulate the target URL or component parameters within the Intent to redirect the user's browser to a phishing site or a drive-by download server.

3. Infrastructure & Business Impact

As a vulnerability listed in the CISA KEV catalog, this flaw has been actively exploited in the wild. If corporate mobile devices are compromised, it can lead to credential theft via sophisticated phishing or mobile malware infection, potentially serving as an entry point for lateral movement into corporate networks.

Official Vendor Advisories & References

NVD Original English Description

Insufficient validation of untrusted input in Intents in Google Chrome on Android prior to 104.0.5112.101 allowed a remote attacker to arbitrarily browse to a malicious website via a crafted HTML page.

https://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop_16.html

Source: chrome-cve-admin@google.com · Patch, Release Notes, Vendor Advisory

https://crbug.com/1345630

Source: chrome-cve-admin@google.com · Exploit, Issue Tracking, Mailing List, Vendor Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4NMJURTG5RO3TGD7ZMIQ6Z4ZZ3SAVYE/

Source: chrome-cve-admin@google.com · Mailing List

https://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop_16.html

Source: af854a3a-2127-422b-91ae-364da2661108 · Patch, Release Notes, Vendor Advisory

https://crbug.com/1345630

Source: af854a3a-2127-422b-91ae-364da2661108 · Exploit, Issue Tracking, Mailing List, Vendor Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4NMJURTG5RO3TGD7ZMIQ6Z4ZZ3SAVYE/

Source: af854a3a-2127-422b-91ae-364da2661108 · Mailing List

Frequently Asked SecOps Questions (CVE-2022-2856)

FAQ

Q1. How critical is CVE-2022-2856 and is it actively exploited in the wild?

CVE-2022-2856 is rated CVSS 6.5 (MEDIUM) with a 30-day EPSS exploitation probability of 4.6%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.

Q2. Which vendors and products are affected by CVE-2022-2856?

Primary impacted vendors include google across chrome. Scope summary: Google Chrome on Android prior to version 104.0.5112.101

Q3. What temporary mitigations or workarounds exist for CVE-2022-2856 before patching?

[Mitigation] Immediately update Google Chrome on Android to version 104.0.5112.101 or later Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.

SECOPS WORKBENCH INTEGRATION