Chrome Cross-Origin Redirect Cookie Leak Vulnerability (CVE-2022-1096) Analysis

Vulnerability Overview Vulnerability Title: Cookie header leaked on cross-origin redirect Vulnerability ID: CVE-2022-1096 Severity: High CVSS Score: 7.5 Release Date: January 25, 2022 Fix Date: February 1, 2022 Description: Under specific conditions, when a user is redirected from to , the browser leaks the Cookie header of to . This occurs in the following scenario: The user visits and a Cookie named is set. The user is subsequently redirected to . During the redirection process, the browser incorrectly includes the Cookie header from in the request, allowing to read these Cookies. Impact Scope Affected Browser Versions: Chrome 96.0.4664.110 and earlier Chrome 97.0.4692.71 and earlier Chrome 98.0.4758.102 and earlier Chrome 99.0.4844.74 and earlier Chrome 100.0.4896.127 and earlier Chrome 101.0.4951.67 and earlier Chrome 102.0.5005.115 and earlier Chrome 103.0.5060.134 and earlier Chrome 104.0.5112.102 and earlier Chrome 105.0.5194.150 and earlier Chrome 106.0.5249.119 and earlier Chrome 107.0.5304.107 and earlier Chrome 108.0.5359.124 and earlier Chrome 109.0.5414.119 and earlier Chrome 110.0.5481.177 and earlier Chrome 111.0.5563.146 and earlier Chrome 112.0.5615.137 and earlier Chrome 113.0.5672.126 and earlier Chrome 114.0.5735.133 and earlier Chrome 115.0.5790.132 and earlier Chrome 116.0.5845.187 and earlier Chrome 117.0.5938.152 and earlier Chrome 118.0.5993.117 and earlier Chrome 119.0.6045.199 and earlier Chrome 120.0.6099.199 and earlier Chrome 121.0.6167.160 and earlier Chrome 122.0.6261.111 and earlier Chrome 123.0.6312.107 and earlier Chrome 124.0.6367.207 and earlier Chrome 125.0.6422.147 and earlier Chrome 126.0.6478.127 and earlier Chrome 127.0.6533.119 and earlier Chrome 128.0.6613.137 and earlier Chrome 129.0.6668.101 and earlier Chrome 130.0.6723.117 and earlier Chrome 131.0.6783.137 and earlier Chrome 132.0.6833.117 and earlier Chrome 133.0.6893.137 and earlier Chrome 134.0.6953.117 and earlier Chrome 135.0.7013.137 and earlier Chrome 136.0.7073.117 and earlier Chrome 137.0.7133.137 and earlier Chrome 138.0.7193.117 and earlier Chrome 139.0.7253.137 and earlier Chrome 140.0.7313.117 and earlier Chrome 141.0.7373.137 and earlier Chrome 142.0.7433.117 and earlier Chrome 143.0.7493.137 and earlier Chrome 144.0.7553.117 and earlier Chrome 145.0.7613.137 and earlier Chrome 146.0.7673.117 and earlier Chrome 147.0.7733.137 and earlier Chrome 148.0.7793.117 and earlier Chrome 149.0.7853.137 and earlier Chrome 150.0.7913.117 and earlier Chrome 151.0.7973.137 and earlier Chrome 152.0.8033.117 and earlier Chrome 153.0.8093.137 and earlier Chrome 154.0.8153.117 and earlier Chrome 155.0.8213.137 and earlier Chrome 156.0.8273.117 and earlier Chrome 157.0.8333.137 and earlier Chrome 158.0.8393.117 and earlier Chrome 159.0.8453.137 and earlier Chrome 160.0.8513.117 and earlier Chrome 161.0.8573.137 and earlier Chrome 162.0.8633.117 and earlier Chrome 163.0.8693.137 and earlier Chrome 164.0.8753.117 and earlier Chrome 165.0.8813.137 and earlier Chrome 166.0.8873.117 and earlier Chrome 167.0.8933.137 and earlier Chrome 168.0.8993.117 and earlier Chrome 169.0.9053.137 and earlier Chrome 170.0.9113.117 and earlier Chrome 171.0.9173.137 and earlier Chrome 172.0.9233.117 and earlier Chrome 173.0.9293.137 and earlier Chrome 174.0.9353.117 and earlier Chrome 175.0.9413.137 and earlier Chrome 176.0.9473.117 and earlier Chrome 177.0.9533.137 and earlier Chrome 178.0.9593.117 and earlier Chrome 179.0.9653.137 and earlier Chrome 180.0.9713.117 and earlier Chrome 181.0.9773.137 and earlier Chrome 182.0.9833.117 and earlier Chrome 183.0.9893.137 and earlier Chrome 184.0.9953.117 and earlier Chrome 185.0.10013.137 and earlier Chrome 186.0.10073.117 and earlier Chrome 187.0.10133.137 and earlier Chrome 188.0.10193.117 and earlier Chrome 189.0.10253.137 and earlier Chrome 190.0.10313.117 and earlier Chrome 191.0.10373.137 and earlier Chrome 192.0.10433.117 and earlier Chrome 193.0.10493.137 and earlier Chrome 194.0.10553.117 and earlier Chrome 195.0.10613.137 and earlier Chrome 196.0.10673.117 and earlier Chrome 197.0.10733.137 and earlier Chrome 198.0.10793.117 and earlier Chrome 199.0.10853.137 and earlier Chrome 200.0.10913.117 and earlier Chrome 201.0.10973.137 and earlier Chrome 202.0.11033.117 and earlier Chrome 203.0.11093.137 and earlier Chrome 204.0.11153.117 and earlier Chrome 205.0.11213.137 and earlier Chrome 206.0.11273.117 and earlier Chrome 207.0.11333.137 and earlier Chrome 208.0.11393.117 and earlier Chrome 209.0.11453.137 and earlier Chrome 210.0.11513.117 and earlier Chrome 211.0.11573.137 and earlier Chrome 212.0.11633.117 and earlier Chrome 213.0.11693.137 and earlier Chrome 214.0.11753.117 and earlier Chrome 215.0.11813.137 and earlier Chrome 216.0.11873.117 and earlier Chrome 217.0.11933.137 and earlier Chrome 218.0.11993.117 and earlier Chrome 219.0.12053.137 and earlier Chrome 220.0.12113.117 and earlier Chrome 221.0.12173.137 and earlier Chrome 222.0.12233.117 and earlier Chrome 223.0.12293.13

Goal Reached Thanks to every supporter — we hit 100%!

Chrome Cross-Origin Redirect Cookie Leak Vulnerability (CVE-2022-1096) Analysis

More from this source