LiveActive security incident?Get immediate response
CVE Record

CVE-2022-4906: Inappropriate implementation in Blink in Google Chrome prior to 108.0.5359.71 allowed a remote attacker to...

Inappropriate implementation in Blink in Google Chrome prior to 108.0.5359.71 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: High)

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

This is a high-severity Chrome browser vulnerability in Blink, Chrome's rendering engine. Before Chrome 108.0.5359.71, a malicious web page could trigger arbitrary read/write behavior. For executives, the main risk is user exposure through normal browsing on outdated Chrome installations.

Executive priority

Prioritize remediation for user workstations because browser flaws can be reached through routine web activity. No active exploitation is evidenced here, but arbitrary read/write in a browser rendering engine justifies prompt patch verification.

Technical view

CVE-2022-4906 is described as an inappropriate implementation in Blink affecting Google Chrome before 108.0.5359.71. The CVE states a remote attacker could perform arbitrary read/write via a crafted HTML page. The source bundle does not provide CVSS, CWE, or deeper root-cause details.

Likely exposure

Organizations are likely exposed where desktop users still run Google Chrome earlier than 108.0.5359.71. The references also include Fedora package announcements, so Linux Chromium package status should be checked through distribution guidance.

Exploitation context

The CVE describes remote attack through a crafted HTML page. The provided sources do not state active exploitation, and the CVE is not marked in CISA KEV. Treat exploitation evidence as unconfirmed from this bundle.

Researcher notes

The source bundle gives limited technical detail beyond Blink, crafted HTML, and arbitrary read/write. The Chromium bug reference is listed, but no root-cause details are included here. Avoid assuming exploit primitives, sandbox escape, or active exploitation without additional vendor evidence.

Mitigation direction

  • Update Google Chrome to 108.0.5359.71 or later.
  • Prefer the latest supported Chrome release from vendor channels.
  • Check Linux distribution advisories for Chromium package updates.
  • Prioritize managed browser update enforcement across endpoints.
  • Review vendor guidance if older embedded browser components exist.

Validation and detection

  • Inventory Chrome versions across managed endpoints.
  • Confirm no Chrome installation is below 108.0.5359.71.
  • Check Linux hosts for affected Chromium package versions.
  • Validate browser auto-update policy is enabled and enforced.
  • Review vulnerability scanner results against actual installed versions.
Prepared
Confidence
medium
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2022-4906 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
5Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
GoogleChrome108.0.5359.71Listed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.