CVE-2022-0337

What it actually does

Inappropriate implementation in the File System API permits a remote attacker to read potentially sensitive information from the victim's local filesystem when a specially crafted HTML page is rendered in Chrome on Windows.

Why it matters to the business

Attackers can obtain sensitive files or data from user systems without user interaction beyond visiting a web page, leading to potential exposure of confidential documents, credentials, or personal information that could result in further compromise or regulatory issues.

How an attack unfolds

An attacker hosts a malicious HTML page that abuses the File System API flaw; when a victim on Windows opens the page in an affected Chrome version, the browser inadvertently exposes local file data back to the attacker-controlled site.

How to fix it

Upgrade Google Chrome on Windows to version 97.0.4692.71 or later. Apply updates promptly across all managed endpoints and verify that auto-update mechanisms are functioning. Where immediate patching is not possible, restrict use of Chrome on Windows for high-risk users and monitor for anomalous file access patterns from browser processes.

How to confirm the fix worked

Confirm Chrome version is 97.0.4692.71 or newer via chrome://version or enterprise management console. Reproduce the original proof-of-concept HTML page in a test environment and verify that no local file data is returned. Scan enterprise endpoints for any remaining installations below the fixed version.

Typical attack path

1. Attacker crafts and hosts a malicious HTML page targeting the File System API
2. Victim is tricked into visiting the page (via phishing, watering hole, or compromised site)
3. Chrome renders the page and triggers the API implementation flaw
4. Sensitive local file data is leaked to the attacker-controlled origin
5. Attacker receives and uses the disclosed information for further attacks

How to detect it

Review web proxy and browser process logs for access to known malicious domains or unusual file:// URI handling. Monitor for Chrome processes making unexpected reads from user profile or document directories. Check endpoint detection tools for any post-exploitation activity following visits to untrusted sites.

What your security team should do

• Prioritize deployment of Chrome 97.0.4692.71+ to all Windows systems within the next patch cycle due to public exploit availability
• Enable enterprise update policies and force automatic updates for Chrome
• Review browser extension and site permissions to limit File System API exposure
• Add browser version checks to vulnerability scanning and asset inventory processes