Security readout for executives and security teams
Plain-English summary
CVE-2022-4923 is a low-severity Chrome Omnibox flaw fixed in Chrome 99.0.4844.51. A person able to tamper with network traffic could use malicious traffic to conduct a man-in-the-middle attack. This is most relevant where users browse on untrusted or compromised networks.
Executive priority
Treat this as routine browser hygiene, not an emergency response item. It should still be closed because browser flaws can affect many users and outdated browsers create avoidable exposure on hostile networks.
Technical view
Google describes an inappropriate implementation in Chrome's Omnibox before 99.0.4844.51. The attack model requires a privileged network position and malicious network traffic. Public sources provided do not include CVSS, CWE, detailed root cause, or public exploit mechanics.
Likely exposure
Exposure is likely limited to endpoints running Google Chrome versions before 99.0.4844.51. Risk is higher for roaming users, unmanaged devices, or systems using old Chromium-derived packages on networks where traffic could be intercepted.
Exploitation context
The supplied sources do not show active exploitation, and the CVE is not in KEV. The described scenario requires a privileged network position, so this is not presented as broadly remote or unauthenticated exploitation from the public internet.
Researcher notes
Technical detail is sparse in the public bundle. The Chromium bug reference is listed, but no exploit details, CVSS vector, CWE, or root-cause specifics are provided here. Analysis should stay bounded to the documented network-position man-in-the-middle condition.
Mitigation direction
- Update Google Chrome to 99.0.4844.51 or later.
- Update Chromium packages through supported OS vendor channels.
- Check Google and distribution advisories for environment-specific guidance.
- Prioritize unmanaged laptops and users frequently on untrusted networks.
Validation and detection
- Inventory browser versions across managed endpoints.
- Confirm Chrome reports version 99.0.4844.51 or later.
- Review Linux package versions against distribution advisories.
- Verify browser update controls are enforcing current stable releases.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2022-4923 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop.htmlCVE reference
- https://crbug.com/1251065CVE reference
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PQKT7EGDD2P3L7S3NXEDDRCPK4NNZNWJ/CVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.