CVE-2022-2160

What it actually does

Insufficient policy enforcement in Chrome DevTools on Windows permits a malicious extension to bypass local file access restrictions and read sensitive user files when a crafted HTML page is loaded.

Why it matters to the business

Attackers who trick users into installing a malicious extension can silently steal sensitive files from the victim's local system, leading to data leakage and potential compliance violations.

How an attack unfolds

An attacker convinces the victim to install a malicious Chrome extension, then delivers a crafted HTML page that interacts with DevTools to read arbitrary local files due to the missing policy check.

How to fix it

Upgrade Google Chrome on Windows to version 103.0.5060.53 or later; on Fedora apply the corresponding packaged update once available.

How to confirm the fix worked

Verify Chrome version is 103.0.5060.53 or newer via chrome://version; confirm extension policies block local-file access in DevTools on test pages.

Typical attack path

1. Social engineering or supply-chain compromise to install malicious extension
2. Victim opens attacker-controlled HTML page in Chrome
3. Extension leverages DevTools APIs to bypass file-access policy
4. Sensitive local files are exfiltrated to attacker-controlled server

How to detect it

Review Chrome extension install logs and browser process creation events for unexpected DevTools activity; inspect network logs for unexpected file-content uploads after extension installs.

What your security team should do

• Prioritize immediate Chrome update across all Windows endpoints
• Audit installed extensions and remove any unapproved or suspicious ones
• Enable Chrome enterprise policies that restrict DevTools and extension permissions
• Monitor EPSS trend and re-evaluate if exploit maturity increases