Security update for chromium SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2022:0125-1 Final 1 1 2022-05-06T07:28:22Z current 2022-05-06T07:28:22Z 2022-05-06T07:28:22Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for chromium This update for chromium fixes the following issues: Chromium 101.0.4951.54 (boo#1199118) Chromium 101.0.4951.41 (boo#1198917): * CVE-2022-1477: Use after free in Vulkan * CVE-2022-1478: Use after free in SwiftShader * CVE-2022-1479: Use after free in ANGLE * CVE-2022-1480: Use after free in Device API * CVE-2022-1481: Use after free in Sharing * CVE-2022-1482: Inappropriate implementation in WebGL * CVE-2022-1483: Heap buffer overflow in WebGPU * CVE-2022-1484: Heap buffer overflow in Web UI Settings * CVE-2022-1485: Use after free in File System API * CVE-2022-1486: Type Confusion in V8 * CVE-2022-1487: Use after free in Ozone * CVE-2022-1488: Inappropriate implementation in Extensions API * CVE-2022-1489: Out of bounds memory access in UI Shelf * CVE-2022-1490: Use after free in Browser Switcher * CVE-2022-1491: Use after free in Bookmarks * CVE-2022-1492: Insufficient data validation in Blink Editing * CVE-2022-1493: Use after free in Dev Tools * CVE-2022-1494: Insufficient data validation in Trusted Types * CVE-2022-1495: Incorrect security UI in Downloads * CVE-2022-1496: Use after free in File Manager * CVE-2022-1497: Inappropriate implementation in Input * CVE-2022-1498: Inappropriate implementation in HTML Parser * CVE-2022-1499: Inappropriate implementation in WebAuthentication * CVE-2022-1500: Insufficient data validation in Dev Tools * CVE-2022-1501: Inappropriate implementation in iframe The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-2022-125 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MHFVFF55YYOTI45WJ3YWL3TU4PVSG5ZU/ E-Mail link for openSUSE-SU-2022:0125-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1198917 SUSE Bug 1198917 https://bugzilla.suse.com/1199118 SUSE Bug 1199118 https://www.suse.com/security/cve/CVE-2022-1477/ SUSE CVE CVE-2022-1477 page https://www.suse.com/security/cve/CVE-2022-1478/ SUSE CVE CVE-2022-1478 page https://www.suse.com/security/cve/CVE-2022-1479/ SUSE CVE CVE-2022-1479 page https://www.suse.com/security/cve/CVE-2022-1480/ SUSE CVE CVE-2022-1480 page https://www.suse.com/security/cve/CVE-2022-1481/ SUSE CVE CVE-2022-1481 page https://www.suse.com/security/cve/CVE-2022-1482/ SUSE CVE CVE-2022-1482 page https://www.suse.com/security/cve/CVE-2022-1483/ SUSE CVE CVE-2022-1483 page https://www.suse.com/security/cve/CVE-2022-1484/ SUSE CVE CVE-2022-1484 page https://www.suse.com/security/cve/CVE-2022-1485/ SUSE CVE CVE-2022-1485 page https://www.suse.com/security/cve/CVE-2022-1486/ SUSE CVE CVE-2022-1486 page https://www.suse.com/security/cve/CVE-2022-1487/ SUSE CVE CVE-2022-1487 page https://www.suse.com/security/cve/CVE-2022-1488/ SUSE CVE CVE-2022-1488 page https://www.suse.com/security/cve/CVE-2022-1489/ SUSE CVE CVE-2022-1489 page https://www.suse.com/security/cve/CVE-2022-1490/ SUSE CVE CVE-2022-1490 page https://www.suse.com/security/cve/CVE-2022-1491/ SUSE CVE CVE-2022-1491 page https://www.suse.com/security/cve/CVE-2022-1492/ SUSE CVE CVE-2022-1492 page https://www.suse.com/security/cve/CVE-2022-1493/ SUSE CVE CVE-2022-1493 page https://www.suse.com/security/cve/CVE-2022-1494/ SUSE CVE CVE-2022-1494 page https://www.suse.com/security/cve/CVE-2022-1495/ SUSE CVE CVE-2022-1495 page https://www.suse.com/security/cve/CVE-2022-1496/ SUSE CVE CVE-2022-1496 page https://www.suse.com/security/cve/CVE-2022-1497/ SUSE CVE CVE-2022-1497 page https://www.suse.com/security/cve/CVE-2022-1498/ SUSE CVE CVE-2022-1498 page https://www.suse.com/security/cve/CVE-2022-1499/ SUSE CVE CVE-2022-1499 page https://www.suse.com/security/cve/CVE-2022-1500/ SUSE CVE CVE-2022-1500 page https://www.suse.com/security/cve/CVE-2022-1501/ SUSE CVE CVE-2022-1501 page SUSE Package Hub 15 SP3 openSUSE Leap 15.3 chromedriver-101.0.4951.54-bp153.2.88.1 chromium-101.0.4951.54-bp153.2.88.1 chromedriver-101.0.4951.54-bp153.2.88.1 as a component of SUSE Package Hub 15 SP3 chromium-101.0.4951.54-bp153.2.88.1 as a component of SUSE Package Hub 15 SP3 chromedriver-101.0.4951.54-bp153.2.88.1 as a component of openSUSE Leap 15.3 chromium-101.0.4951.54-bp153.2.88.1 as a component of openSUSE Leap 15.3 Use after free in Vulkan in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. CVE-2022-1477 SUSE Package Hub 15 SP3:chromedriver-101.0.4951.54-bp153.2.88.1 SUSE Package Hub 15 SP3:chromium-101.0.4951.54-bp153.2.88.1 openSUSE Leap 15.3:chromedriver-101.0.4951.54-bp153.2.88.1 openSUSE Leap 15.3:chromium-101.0.4951.54-bp153.2.88.1 important 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MHFVFF55YYOTI45WJ3YWL3TU4PVSG5ZU/ https://www.suse.com/security/cve/CVE-2022-1477.html CVE-2022-1477 https://bugzilla.suse.com/1198917 SUSE Bug 1198917 Use after free in SwiftShader in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. CVE-2022-1478 SUSE Package Hub 15 SP3:chromedriver-101.0.4951.54-bp153.2.88.1 SUSE Package Hub 15 SP3:chromium-101.0.4951.54-bp153.2.88.1 openSUSE Leap 15.3:chromedriver-101.0.4951.54-bp153.2.88.1 openSUSE Leap 15.3:chromium-101.0.4951.54-bp153.2.88.1 important 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MHFVFF55YYOTI45WJ3YWL3TU4PVSG5ZU/ https://www.suse.com/security/cve/CVE-2022-1478.html CVE-2022-1478 https://bugzilla.suse.com/1198917 SUSE Bug 1198917 Use after free in ANGLE in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. CVE-2022-1479 SUSE Package Hub 15 SP3:chromedriver-101.0.4951.54-bp153.2.88.1 SUSE Package Hub 15 SP3:chromium-101.0.4951.54-bp153.2.88.1 openSUSE Leap 15.3:chromedriver-101.0.4951.54-bp153.2.88.1 openSUSE Leap 15.3:chromium-101.0.4951.54-bp153.2.88.1 important 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MHFVFF55YYOTI45WJ3YWL3TU4PVSG5ZU/ https://www.suse.com/security/cve/CVE-2022-1479.html CVE-2022-1479 https://bugzilla.suse.com/1198917 SUSE Bug 1198917 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none. CVE-2022-1480 SUSE Package Hub 15 SP3:chromedriver-101.0.4951.54-bp153.2.88.1 SUSE Package Hub 15 SP3:chromium-101.0.4951.54-bp153.2.88.1 openSUSE Leap 15.3:chromedriver-101.0.4951.54-bp153.2.88.1 openSUSE Leap 15.3:chromium-101.0.4951.54-bp153.2.88.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MHFVFF55YYOTI45WJ3YWL3TU4PVSG5ZU/ https://www.suse.com/security/cve/CVE-2022-1480.html CVE-2022-1480 https://bugzilla.suse.com/1198917 SUSE Bug 1198917 Use after free in Sharing in Google Chrome on Mac prior to 101.0.4951.41 allowed a remote attacker who convinced a user to engage in specific user interaction to potentially exploit heap corruption via a crafted HTML page. CVE-2022-1481 SUSE Package Hub 15 SP3:chromedriver-101.0.4951.54-bp153.2.88.1 SUSE Package Hub 15 SP3:chromium-101.0.4951.54-bp153.2.88.1 openSUSE Leap 15.3:chromedriver-101.0.4951.54-bp153.2.88.1 openSUSE Leap 15.3:chromium-101.0.4951.54-bp153.2.88.1 important 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MHFVFF55YYOTI45WJ3YWL3TU4PVSG5ZU/ https://www.suse.com/security/cve/CVE-2022-1481.html CVE-2022-1481 https://bugzilla.suse.com/1198917 SUSE Bug 1198917 Inappropriate implementation in WebGL in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. CVE-2022-1482 SUSE Package Hub 15 SP3:chromedriver-101.0.4951.54-bp153.2.88.1 SUSE Package Hub 15 SP3:chromium-101.0.4951.54-bp153.2.88.1 openSUSE Leap 15.3:chromedriver-101.0.4951.54-bp153.2.88.1 openSUSE Leap 15.3:chromium-101.0.4951.54-bp153.2.88.1 important 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MHFVFF55YYOTI45WJ3YWL3TU4PVSG5ZU/ https://www.suse.com/security/cve/CVE-2022-1482.html CVE-2022-1482 https://bugzilla.suse.com/1198917 SUSE Bug 1198917 Heap buffer overflow in WebGPU in Google Chrome prior to 101.0.4951.41 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. CVE-2022-1483 SUSE Package Hub 15 SP3:chromedriver-101.0.4951.54-bp153.2.88.1 SUSE Package Hub 15 SP3:chromium-101.0.4951.54-bp153.2.88.1 openSUSE Leap 15.3:chromedriver-101.0.4951.54-bp153.2.88.1 openSUSE Leap 15.3:chromium-101.0.4951.54-bp153.2.88.1 important 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MHFVFF55YYOTI45WJ3YWL3TU4PVSG5ZU/ https://www.suse.com/security/cve/CVE-2022-1483.html CVE-2022-1483 https://bugzilla.suse.com/1198917 SUSE Bug 1198917 Heap buffer overflow in Web UI Settings in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. CVE-2022-1484 SUSE Package Hub 15 SP3:chromedriver-101.0.4951.54-bp153.2.88.1 SUSE Package Hub 15 SP3:chromium-101.0.4951.54-bp153.2.88.1 openSUSE Leap 15.3:chromedriver-101.0.4951.54-bp153.2.88.1 openSUSE Leap 15.3:chromium-101.0.4951.54-bp153.2.88.1 important 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MHFVFF55YYOTI45WJ3YWL3TU4PVSG5ZU/ https://www.suse.com/security/cve/CVE-2022-1484.html CVE-2022-1484 https://bugzilla.suse.com/1198917 SUSE Bug 1198917 Use after free in File System API in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. CVE-2022-1485 SUSE Package Hub 15 SP3:chromedriver-101.0.4951.54-bp153.2.88.1 SUSE Package Hub 15 SP3:chromium-101.0.4951.54-bp153.2.88.1 openSUSE Leap 15.3:chromedriver-101.0.4951.54-bp153.2.88.1 openSUSE Leap 15.3:chromium-101.0.4951.54-bp153.2.88.1 important 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MHFVFF55YYOTI45WJ3YWL3TU4PVSG5ZU/ https://www.suse.com/security/cve/CVE-2022-1485.html CVE-2022-1485 https://bugzilla.suse.com/1198917 SUSE Bug 1198917 Type confusion in V8 in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. CVE-2022-1486 SUSE Package Hub 15 SP3:chromedriver-101.0.4951.54-bp153.2.88.1 SUSE Package Hub 15 SP3:chromium-101.0.4951.54-bp153.2.88.1 openSUSE Leap 15.3:chromedriver-101.0.4951.54-bp153.2.88.1 openSUSE Leap 15.3:chromium-101.0.4951.54-bp153.2.88.1 important 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MHFVFF55YYOTI45WJ3YWL3TU4PVSG5ZU/ https://www.suse.com/security/cve/CVE-2022-1486.html CVE-2022-1486 https://bugzilla.suse.com/1198917 SUSE Bug 1198917 Use after free in Ozone in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to potentially exploit heap corruption via running a Wayland test. CVE-2022-1487 SUSE Package Hub 15 SP3:chromedriver-101.0.4951.54-bp153.2.88.1 SUSE Package Hub 15 SP3:chromium-101.0.4951.54-bp153.2.88.1 openSUSE Leap 15.3:chromedriver-101.0.4951.54-bp153.2.88.1 openSUSE Leap 15.3:chromium-101.0.4951.54-bp153.2.88.1 important 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MHFVFF55YYOTI45WJ3YWL3TU4PVSG5ZU/ https://www.suse.com/security/cve/CVE-2022-1487.html CVE-2022-1487 https://bugzilla.suse.com/1198917 SUSE Bug 1198917 Inappropriate implementation in Extensions API in Google Chrome prior to 101.0.4951.41 allowed an attacker who convinced a user to install a malicious extension to leak cross-origin data via a crafted Chrome Extension. CVE-2022-1488 SUSE Package Hub 15 SP3:chromedriver-101.0.4951.54-bp153.2.88.1 SUSE Package Hub 15 SP3:chromium-101.0.4951.54-bp153.2.88.1 openSUSE Leap 15.3:chromedriver-101.0.4951.54-bp153.2.88.1 openSUSE Leap 15.3:chromium-101.0.4951.54-bp153.2.88.1 important 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MHFVFF55YYOTI45WJ3YWL3TU4PVSG5ZU/ https://www.suse.com/security/cve/CVE-2022-1488.html CVE-2022-1488 https://bugzilla.suse.com/1198917 SUSE Bug 1198917 Out of bounds memory access in UI Shelf in Google Chrome on Chrome OS, Lacros prior to 101.0.4951.41 allowed a remote attacker to potentially exploit heap corruption via specific user interactions. CVE-2022-1489 SUSE Package Hub 15 SP3:chromedriver-101.0.4951.54-bp153.2.88.1 SUSE Package Hub 15 SP3:chromium-101.0.4951.54-bp153.2.88.1 openSUSE Leap 15.3:chromedriver-101.0.4951.54-bp153.2.88.1 openSUSE Leap 15.3:chromium-101.0.4951.54-bp153.2.88.1 important 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MHFVFF55YYOTI45WJ3YWL3TU4PVSG5ZU/ https://www.suse.com/security/cve/CVE-2022-1489.html CVE-2022-1489 https://bugzilla.suse.com/1198917 SUSE Bug 1198917 Use after free in Browser Switcher in Google Chrome prior to 101.0.4951.41 allowed a remote attacker who convinced a user to engage in specific user interaction to potentially exploit heap corruption via a crafted HTML page. CVE-2022-1490 SUSE Package Hub 15 SP3:chromedriver-101.0.4951.54-bp153.2.88.1 SUSE Package Hub 15 SP3:chromium-101.0.4951.54-bp153.2.88.1 openSUSE Leap 15.3:chromedriver-101.0.4951.54-bp153.2.88.1 openSUSE Leap 15.3:chromium-101.0.4951.54-bp153.2.88.1 important 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MHFVFF55YYOTI45WJ3YWL3TU4PVSG5ZU/ https://www.suse.com/security/cve/CVE-2022-1490.html CVE-2022-1490 https://bugzilla.suse.com/1198917 SUSE Bug 1198917 Use after free in Bookmarks in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to potentially exploit heap corruption via specific and direct user interaction. CVE-2022-1491 SUSE Package Hub 15 SP3:chromedriver-101.0.4951.54-bp153.2.88.1 SUSE Package Hub 15 SP3:chromium-101.0.4951.54-bp153.2.88.1 openSUSE Leap 15.3:chromedriver-101.0.4951.54-bp153.2.88.1 openSUSE Leap 15.3:chromium-101.0.4951.54-bp153.2.88.1 important 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MHFVFF55YYOTI45WJ3YWL3TU4PVSG5ZU/ https://www.suse.com/security/cve/CVE-2022-1491.html CVE-2022-1491 https://bugzilla.suse.com/1198917 SUSE Bug 1198917 Insufficient data validation in Blink Editing in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to inject arbitrary scripts or HTML via a crafted HTML page. CVE-2022-1492 SUSE Package Hub 15 SP3:chromedriver-101.0.4951.54-bp153.2.88.1 SUSE Package Hub 15 SP3:chromium-101.0.4951.54-bp153.2.88.1 openSUSE Leap 15.3:chromedriver-101.0.4951.54-bp153.2.88.1 openSUSE Leap 15.3:chromium-101.0.4951.54-bp153.2.88.1 important 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MHFVFF55YYOTI45WJ3YWL3TU4PVSG5ZU/ https://www.suse.com/security/cve/CVE-2022-1492.html CVE-2022-1492 https://bugzilla.suse.com/1198917 SUSE Bug 1198917 Use after free in Dev Tools in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to potentially exploit heap corruption via specific and direct user interaction. CVE-2022-1493 SUSE Package Hub 15 SP3:chromedriver-101.0.4951.54-bp153.2.88.1 SUSE Package Hub 15 SP3:chromium-101.0.4951.54-bp153.2.88.1 openSUSE Leap 15.3:chromedriver-101.0.4951.54-bp153.2.88.1 openSUSE Leap 15.3:chromium-101.0.4951.54-bp153.2.88.1 important 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MHFVFF55YYOTI45WJ3YWL3TU4PVSG5ZU/ https://www.suse.com/security/cve/CVE-2022-1493.html CVE-2022-1493 https://bugzilla.suse.com/1198917 SUSE Bug 1198917 Insufficient data validation in Trusted Types in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to bypass trusted types policy via a crafted HTML page. CVE-2022-1494 SUSE Package Hub 15 SP3:chromedriver-101.0.4951.54-bp153.2.88.1 SUSE Package Hub 15 SP3:chromium-101.0.4951.54-bp153.2.88.1 openSUSE Leap 15.3:chromedriver-101.0.4951.54-bp153.2.88.1 openSUSE Leap 15.3:chromium-101.0.4951.54-bp153.2.88.1 important 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MHFVFF55YYOTI45WJ3YWL3TU4PVSG5ZU/ https://www.suse.com/security/cve/CVE-2022-1494.html CVE-2022-1494 https://bugzilla.suse.com/1198917 SUSE Bug 1198917 Incorrect security UI in Downloads in Google Chrome on Android prior to 101.0.4951.41 allowed a remote attacker to spoof the APK downloads dialog via a crafted HTML page. CVE-2022-1495 SUSE Package Hub 15 SP3:chromedriver-101.0.4951.54-bp153.2.88.1 SUSE Package Hub 15 SP3:chromium-101.0.4951.54-bp153.2.88.1 openSUSE Leap 15.3:chromedriver-101.0.4951.54-bp153.2.88.1 openSUSE Leap 15.3:chromium-101.0.4951.54-bp153.2.88.1 important 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MHFVFF55YYOTI45WJ3YWL3TU4PVSG5ZU/ https://www.suse.com/security/cve/CVE-2022-1495.html CVE-2022-1495 https://bugzilla.suse.com/1198917 SUSE Bug 1198917 Use after free in File Manager in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to potentially exploit heap corruption via specific and direct user interaction. CVE-2022-1496 SUSE Package Hub 15 SP3:chromedriver-101.0.4951.54-bp153.2.88.1 SUSE Package Hub 15 SP3:chromium-101.0.4951.54-bp153.2.88.1 openSUSE Leap 15.3:chromedriver-101.0.4951.54-bp153.2.88.1 openSUSE Leap 15.3:chromium-101.0.4951.54-bp153.2.88.1 important 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MHFVFF55YYOTI45WJ3YWL3TU4PVSG5ZU/ https://www.suse.com/security/cve/CVE-2022-1496.html CVE-2022-1496 https://bugzilla.suse.com/1198917 SUSE Bug 1198917 Inappropriate implementation in Input in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to spoof the contents of cross-origin websites via a crafted HTML page. CVE-2022-1497 SUSE Package Hub 15 SP3:chromedriver-101.0.4951.54-bp153.2.88.1 SUSE Package Hub 15 SP3:chromium-101.0.4951.54-bp153.2.88.1 openSUSE Leap 15.3:chromedriver-101.0.4951.54-bp153.2.88.1 openSUSE Leap 15.3:chromium-101.0.4951.54-bp153.2.88.1 important 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MHFVFF55YYOTI45WJ3YWL3TU4PVSG5ZU/ https://www.suse.com/security/cve/CVE-2022-1497.html CVE-2022-1497 https://bugzilla.suse.com/1198917 SUSE Bug 1198917 Inappropriate implementation in HTML Parser in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to leak cross-origin data via a crafted HTML page. CVE-2022-1498 SUSE Package Hub 15 SP3:chromedriver-101.0.4951.54-bp153.2.88.1 SUSE Package Hub 15 SP3:chromium-101.0.4951.54-bp153.2.88.1 openSUSE Leap 15.3:chromedriver-101.0.4951.54-bp153.2.88.1 openSUSE Leap 15.3:chromium-101.0.4951.54-bp153.2.88.1 important 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MHFVFF55YYOTI45WJ3YWL3TU4PVSG5ZU/ https://www.suse.com/security/cve/CVE-2022-1498.html CVE-2022-1498 https://bugzilla.suse.com/1198917 SUSE Bug 1198917 Inappropriate implementation in WebAuthentication in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to bypass same origin policy via a crafted HTML page. CVE-2022-1499 SUSE Package Hub 15 SP3:chromedriver-101.0.4951.54-bp153.2.88.1 SUSE Package Hub 15 SP3:chromium-101.0.4951.54-bp153.2.88.1 openSUSE Leap 15.3:chromedriver-101.0.4951.54-bp153.2.88.1 openSUSE Leap 15.3:chromium-101.0.4951.54-bp153.2.88.1 important 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MHFVFF55YYOTI45WJ3YWL3TU4PVSG5ZU/ https://www.suse.com/security/cve/CVE-2022-1499.html CVE-2022-1499 https://bugzilla.suse.com/1198917 SUSE Bug 1198917 Insufficient data validation in Dev Tools in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to bypass content security policy via a crafted HTML page. CVE-2022-1500 SUSE Package Hub 15 SP3:chromedriver-101.0.4951.54-bp153.2.88.1 SUSE Package Hub 15 SP3:chromium-101.0.4951.54-bp153.2.88.1 openSUSE Leap 15.3:chromedriver-101.0.4951.54-bp153.2.88.1 openSUSE Leap 15.3:chromium-101.0.4951.54-bp153.2.88.1 important 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MHFVFF55YYOTI45WJ3YWL3TU4PVSG5ZU/ https://www.suse.com/security/cve/CVE-2022-1500.html CVE-2022-1500 https://bugzilla.suse.com/1198917 SUSE Bug 1198917 Inappropriate implementation in iframe in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to leak cross-origin data via a crafted HTML page. CVE-2022-1501 SUSE Package Hub 15 SP3:chromedriver-101.0.4951.54-bp153.2.88.1 SUSE Package Hub 15 SP3:chromium-101.0.4951.54-bp153.2.88.1 openSUSE Leap 15.3:chromedriver-101.0.4951.54-bp153.2.88.1 openSUSE Leap 15.3:chromium-101.0.4951.54-bp153.2.88.1 important 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MHFVFF55YYOTI45WJ3YWL3TU4PVSG5ZU/ https://www.suse.com/security/cve/CVE-2022-1501.html CVE-2022-1501 https://bugzilla.suse.com/1198917 SUSE Bug 1198917