CVE-2022-22754

What it actually does

An extension of a particular type could auto-update itself and bypass the prompt granting new requested permissions to the updated version.

Why it matters to the business

Attackers could obtain unauthorized elevated capabilities in affected installations without user awareness, increasing risk of data access or manipulation; low urgency given age and lack of known exploitation campaigns.

How an attack unfolds

An attacker supplies or compromises an extension of the vulnerable type; after user installation the extension performs a silent auto-update that requests additional permissions while suppressing the consent prompt, resulting in the new version operating with expanded access.

How to fix it

Upgrade diffplug/goomph (GIT) to the fixed commit 25f04f67ba62d9a14104bee13a0a0f2517afb8c8.

How to confirm the fix worked

Verify the installed revision matches or is after commit 25f04f67ba62d9a14104bee13a0a0f2517afb8c8 and confirm permission prompts are enforced on extension updates.

Typical attack path

1. User installs an extension of the affected type
2. Attacker-controlled or compromised extension initiates auto-update
3. Update process bypasses permission grant prompt
4. Extension receives and uses newly requested permissions without consent

How to detect it

Inspect extension update logs and permission change events for instances where new capabilities were granted without recorded user consent prompts.

What your security team should do

• Apply the fixed commit to all instances of the affected package
• Audit installed extensions for unexpected permission changes
• Review extension update logs for bypassed prompts