« Volver al listado

CVE-2022-1139

Estado: ModificadaMedia (6.5)—

Una implementación inapropiada de Background Fetch API en Google Chrome versiones anteriores a 100.0.4896.60, permitía a un atacante remoto filtrar datos de origen cruzado por medio de una página HTML diseñada

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Google — Chrome

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-1139",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "chrome-cve-admin@google.com",
      "affectedData": [
        {
          "vendor": "Google",
          "product": "Chrome",
          "versions": [
            {
              "status": "affected",
              "version": "unspecified",
              "lessThan": "100.0.4896.60",
              "versionType": "custom"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-07-23T00:15:08.980",
  "references": [
    {
      "url": "https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop_29.html",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ],
      "source": "chrome-cve-admin@google.com"
    },
    {
      "url": "https://crbug.com/1268541",
      "tags": [
        "Exploit",
        "Issue Tracking",
        "Patch",
        "Vendor Advisory"
      ],
      "source": "chrome-cve-admin@google.com"
    },
    {
      "url": "https://security.gentoo.org/glsa/202208-25",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "chrome-cve-admin@google.com"
    },
    {
      "url": "https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop_29.html",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://crbug.com/1268541",
      "tags": [
        "Exploit",
        "Issue Tracking",
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://security.gentoo.org/glsa/202208-25",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-203"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Inappropriate implementation in Background Fetch API in Google Chrome prior to 100.0.4896.60 allowed a remote attacker to leak cross-origin data via a crafted HTML page."
    },
    {
      "lang": "es",
      "value": "Una implementación inapropiada de Background Fetch API en Google Chrome versiones anteriores a 100.0.4896.60, permitía a un atacante remoto filtrar datos de origen cruzado por medio de una página HTML diseñada"
    }
  ],
  "lastModified": "2026-06-17T04:21:53.900",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BCD685B8-4FC8-4D73-9946-84FF1CF0FC51",
              "versionEndExcluding": "100.0.4896.60"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "chrome-cve-admin@google.com"
}