{"metadata": {"vulnerability": "CVE-2022-4908", "count": 23, "kinds": {"milestone": 4, "sighting": 10, "kev": 0, "other": 9}}, "data": [{"timestamp": "2023-02-12T21:29:41.334Z", "date_only": false, "value": "2023-02-12T21:29:41.334Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2022-4908", "field": "cveMetadata.dateReserved"}, {"timestamp": "2023-07-28T23:26:49.962Z", "date_only": false, "value": "2023-07-28T23:26:49.962Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2022-4908", "field": "cveMetadata.datePublished"}, {"timestamp": "2023-07-29T00:15:00Z", "date_only": false, "value": "2023-07-29T00:15Z", "kind": "other", "label": "Published Date", "source": "gsd \u00b7 GSD-2022-4908", "record": "GSD-2022-4908", "field": "namespaces.nvd.nist.gov.publishedDate"}, {"timestamp": "2023-07-29T00:15:10Z", "date_only": false, "value": "2023-07-29T00:15:10Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-P65Q-VRRQ-VW5V", "record": "GHSA-P65Q-VRRQ-VW5V", "field": "database_specific.nvd_published_at"}, {"timestamp": "2023-07-29T00:15:10.917Z", "date_only": false, "value": "2023-07-29T00:15:10.917", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2022-4908", "record": "FKIE_CVE-2022-4908", "field": "published"}, {"timestamp": "2023-07-29T00:30:47Z", "date_only": false, "value": "2023-07-29T00:30:47Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-P65Q-VRRQ-VW5V", "record": "GHSA-P65Q-VRRQ-VW5V", "field": "published"}, {"timestamp": "2023-07-29T07:30:02Z", "date_only": false, "value": "2023-07-29T07:30:02.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/cibsecurity/67404", "record": "CVE-2022-4908", "field": "creation_timestamp", "uuid": "8ff5fe0f-7b22-493c-8d2c-7db0323a4878", "content": "\u203c CVE-2022-4908 \u203c\n\nInappropriate implementation in iFrame Sandbox in Google Chrome prior to 107.0.5304.62 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "url": "https://t.me/cibsecurity/67404"}, {"timestamp": "2023-08-10T02:06:43.026Z", "date_only": false, "value": "2023-08-10T02:06:43.026Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Chrome", "record": "CVE-2022-4908", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2023-08-10T03:15:00Z", "date_only": false, "value": "2023-08-10T03:15Z", "kind": "other", "label": "Last Modified Date", "source": "gsd \u00b7 GSD-2022-4908", "record": "GSD-2022-4908", "field": "namespaces.nvd.nist.gov.lastModifiedDate"}, {"timestamp": "2023-10-10T09:37:00Z", "date_only": false, "value": "2023-10-10T09:37:00.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/thebugbountyhunter/7858", "record": "CVE-2022-4908", "field": "creation_timestamp", "uuid": "d5c5f0fd-cce5-4f9b-85d0-834f0210f274", "content": "CVE-2022-4908: SOP bypass in Chrome using Navigation API - Johan Carlsson\n\nhttps://joaxcar.com/blog/2023/10/06/cve-2022-4908-sop-bypass-in-chrome-using-navigation-api/", "url": "https://t.me/thebugbountyhunter/7858"}, {"timestamp": "2023-12-13T01:19:15.765Z", "date_only": false, "value": "2023-12-13T01:19:15.765179Z", "kind": "other", "label": "Updated", "source": "gsd \u00b7 GSD-2022-4908", "record": "GSD-2022-4908", "field": "gsd.osvSchema.modified"}, {"timestamp": "2024-01-25T19:25:42Z", "date_only": false, "value": "2024-01-25T19:25:42.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/S_E_Reborn/4443", "record": "CVE-2022-4908", "field": "creation_timestamp", "uuid": "f855ece5-7549-44e8-8d46-6552b12ae192", "content": "\ud83c\udf0d Top 10 web hacking techniques of 2023..\n\n\u2022  \u041d\u043e\u043c\u0438\u043d\u0430\u0446\u0438\u044f - top 10 \u043b\u0443\u0447\u0448\u0438\u0445 \u043c\u0435\u0442\u043e\u0434\u043e\u0432 \u0432\u0435\u0431-\u0432\u0437\u043b\u043e\u043c\u0430 \u0432 2023 \u0433\u043e\u0434\u0443. \u041a\u0430\u0436\u0434\u0430\u044f \u0441\u0442\u0430\u0442\u044c\u044f \u0437\u0430\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u0435\u0442 \u0432\u043d\u0438\u043c\u0430\u043d\u0438\u044f:\n\n - Ransacking your password reset tokens;\n - mTLS: When certificate authentication is done wrong;\n - Smashing the state machine: the true potential of web race conditions;\n - Bypass firewalls with of-CORs and typo-squatting;\n - RCE via LDAP truncation on hg.mozilla.org;\n - Cookie Bugs - Smuggling & Injection;\n - OAuth 2.0 Redirect URI Validation Falls Short, Literally;\n - Prototype Pollution in Python;\n - Pretalx Vulnerabilities: How to get accepted at every conference;\n - From Akamai to F5 to NTLM... with love;\n - can I speak to your manager? hacking root EPP servers to take control of zones;\n - Blind CSS Exfiltration: exfiltrate unknown web pages;\n - Server-side prototype pollution: Black-box detection without the DoS;\n - Tricks for Reliable Split-Second DNS Rebinding in Chrome and Safari;\n - HTML Over the Wire;\n - SMTP Smuggling - Spoofing E-Mails Worldwide;\n - DOM-based race condition: racing in the browser for fun;\n - You Are Not Where You Think You Are, Opera Browsers Address Bar Spoofing Vulnerabilities;\n - CVE-2022-4908: SOP bypass in Chrome using Navigation API;\n - SSO Gadgets: Escalate (Self-)XSS to ATO;\n - Three New Attacks Against JSON Web Tokens;\n - Introducing wrapwrap: using PHP filters to wrap a file with a prefix and suffix;\n - PHP filter chains: file read from error-based oracle;\n - SSRF Cross Protocol Redirect Bypass;\n - A New Vector For \u201cDirty\u201d Arbitrary File Write to RCE;\n - How I Hacked Microsoft Teams and got $150,000 in Pwn2Own;\n - AWS WAF Clients Left Vulnerable to SQL Injection Due to Unorthodox MSSQL Design Choice;\n - BingBang: AAD misconfiguration led to Bing.com results manipulation and account takeover;\n - MyBB Admin Panel RCE CVE-2023-41362;\n - Source Code at Risk: Critical Code Vulnerability in CI/CD Platform TeamCity;\n - Code Vulnerabilities Put Skiff Emails at Riskr;\n - How to break SAML if I have paws?\n - JMX Exploitation Revisited;\n - Java Exploitation Restrictions in Modern JDK Times;\n - Exploiting Hardened .NET Deserialization;\n - Unserializable, but unreachable: Remote code execution on vBulletin;\n - Cookieless DuoDrop: IIS Auth Bypass & App Pool Privesc in ASP.NET Framework;\n - Hunting for Nginx Alias Traversals in the wild;\n - DNS Analyzer - Finding DNS vulnerabilities with Burp Suite;\n - Oh-Auth - Abusing OAuth to take over millions of accounts;\n - nOAuth: How Microsoft OAuth Misconfiguration Can Lead to Full Account Takeover;\n - One Scheme to Rule Them All: OAuth Account Takeover;\n - Exploiting HTTP Parsers Inconsistencies;\n - New ways of breaking app-integrated LLMs;\n - State of DNS Rebinding in 2023;\n - Fileless Remote Code Execution on Juniper Firewalls;\n - Thirteen Years On: Advancing the Understanding of IIS Short File Name (SFN) Disclosure!\n - Metamask Snaps: Playing in the Sand;\n - Uncovering a crazy privilege escalation from Chrome extensions;\n - Code Vulnerabilities Put Proton Mails at Risk;\n - Hacking into gRPC-Web;\n - Yelp ATO via XSS + Cookie Bridge;\n - HTTP Request Splitting vulnerabilities exploitation;\n - XSS in GMAIL Dynamic Email;\n - Azure B2C Crypto Misuse and Account Compromise;\n - Compromising F5 BIGIP with Request Smuggling;\n - One Supply Chain Attack to Rule Them All;\n - Cookie Crumbles: Breaking and Fixing Web Session Integrity;\n - tRPC Security Research: Hunting for Vulnerabilities in Modern APIs;\n - From an Innocent Client-Side Path Traversal to Account Takeover.\n\n#web #hack", "url": "https://t.me/S_E_Reborn/4443"}, {"timestamp": "2024-04-04T06:25:20Z", "date_only": false, "value": "2024-04-04T06:25:20Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-P65Q-VRRQ-VW5V", "record": "GHSA-P65Q-VRRQ-VW5V", "field": "modified"}, {"timestamp": "2024-07-27T20:09:08Z", "date_only": false, "value": "2024-07-27T20:09:08.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/thebugbountyhunter/7884", "record": "CVE-2022-4908", "field": "creation_timestamp", "uuid": "04e375de-52e8-42e9-b6fd-f007f5a45360", "content": "CVE-2022-4908: SOP bypass in Chrome using Navigation API - Johan Carlsson\n\nhttps://joaxcar.com/blog/2023/10/06/cve-2022-4908-sop-bypass-in-chrome-using-navigation-api/", "url": "https://t.me/thebugbountyhunter/7884"}, {"timestamp": "2024-08-03T01:55:45.988Z", "date_only": false, "value": "2024-08-03T01:55:45.988Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CVE", "record": "CVE-2022-4908", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2024-08-16T08:32:36Z", "date_only": false, "value": "2024-08-16T08:32:36.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/Rootsec_2/1327", "record": "CVE-2022-4908", "field": "creation_timestamp", "uuid": "e6d5acc1-178f-43dd-80ee-df0a10413a29", "content": "#exploit\n1. CVE-2023-43641:\n1-Click RCE on GNOME (libcue)\nhttps://github.blog/2023-10-09-coordinated-disclosure-1-click-rce-on-gnome-cve-2023-43641\n\n2. CVE-2022-4908:\nSOP bypass in Chrome using Navigation API\nhttps://joaxcar.com/blog/2023/10/06/cve-2022-4908-sop-bypass-in-chrome-using-navigation-api\n\n3. CVE-2023-2640, CVE-2023-32629:\n\"GameOver(lay)\" Ubuntu Privilege Escalation\nhttps://github.com/g1vi/CVE-2023-2640-CVE-2023-32629", "url": "https://t.me/Rootsec_2/1327"}, {"timestamp": "2025-01-24T11:06:04Z", "date_only": false, "value": "2025-01-24T11:06:04.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/CyberSecurityTechnologies/9175", "record": "CVE-2022-4908", "field": "creation_timestamp", "uuid": "781d3574-4380-44eb-8dcb-06f6bce84b1a", "content": "#exploit\n1. CVE-2023-43641:\n1-Click RCE on GNOME (libcue)\nhttps://github.blog/2023-10-09-coordinated-disclosure-1-click-rce-on-gnome-cve-2023-43641\n\n2. CVE-2022-4908:\nSOP bypass in Chrome using Navigation API\nhttps://joaxcar.com/blog/2023/10/06/cve-2022-4908-sop-bypass-in-chrome-using-navigation-api\n\n3. CVE-2023-2640, CVE-2023-32629:\n\"GameOver(lay)\" Ubuntu Privilege Escalation\nhttps://github.com/g1vi/CVE-2023-2640-CVE-2023-32629", "url": "https://t.me/CyberSecurityTechnologies/9175"}, {"timestamp": "2025-02-13T16:38:26.360Z", "date_only": false, "value": "2025-02-13T16:38:26.360Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2022-4908", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-06-17T05:22:16.223Z", "date_only": false, "value": "2026-06-17T05:22:16.223", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2022-4908", "record": "FKIE_CVE-2022-4908", "field": "lastModified"}, {"timestamp": "2026-07-17T11:00:06.145Z", "date_only": false, "value": "2026-07-17T11:00:06.145977Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/cyberwarehouse/287", "record": "CVE-2022-4908", "field": "creation_timestamp", "uuid": "6b4f8960-9587-4435-9267-ff2c34e9dd4a", "url": "https://t.me/cyberwarehouse/287"}, {"timestamp": "2026-07-18T00:00:29.756Z", "date_only": false, "value": "2026-07-18T00:00:29.756152Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/cyberwarehouse/287", "record": "CVE-2022-4908", "field": "creation_timestamp", "uuid": "cf8abc6c-2595-4307-abab-b83ded2d78fd", "url": "https://t.me/cyberwarehouse/287"}, {"timestamp": "2026-07-21T13:00:06.384Z", "date_only": false, "value": "2026-07-21T13:00:06.384753Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GitBook_s/204", "record": "CVE-2022-4908", "field": "creation_timestamp", "uuid": "36e57bb4-8775-4217-bbb2-c6497dbbeee4", "url": "https://t.me/GitBook_s/204"}, {"timestamp": "2026-07-22T00:00:22.703Z", "date_only": false, "value": "2026-07-22T00:00:22.703298Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GitBook_s/204", "record": "CVE-2022-4908", "field": "creation_timestamp", "uuid": "c92bbc1f-31ec-4b3f-aee6-bf551526cb2e", "url": "https://t.me/GitBook_s/204"}]}