CVE-2022-29147: Microsoft Edge (Chromium-based) Spoofing Vulnerability

Overview

Severity

Low (CVSS 3.1)

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C

Category

Edge - Chromium

Exploit Status

Not Exploited

Exploitation Likelihood

Less Likely

Patch Tuesday

2022-Apr

Released

2022-04-28

EPSS Score

1.52% (percentile: 81.3%)

FAQ

What is the version information for this release? Microsoft Edge Version Date Released Based on Chromium Version 101.0.1210.32 4/28/2022 101.0.4951.41 According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability? Successful exploitation of this vulnerability requires an attacker to first prepare the target so that it uses Edge in Internet Explorer Mode. What is Microsoft Edge (Chromium-based) in IE Mode? Microsoft Edge (Chromium-based) in IE Mode is a feature that emulates Internet Explorer from within Microsoft Edge (Chromium-based). For more information please see About IE Mode. How do I get the update that addresses this Microsoft Edge (Chromium-based) in Internet Explorer Mode vulnerability? The Microsoft Edge (Chromium-based) browser will provide the update for Microsoft Edge in IE mode. No Windows update is required.

Affected Products (1)

Browser

• Microsoft Edge (Chromium-based)

Acknowledgments

Anonymous

Revision History

• 2022-04-28: Information published.