CVE-2022-21929
Published: 11 January 2022
Summary
CVE-2022-21929 is a low-severity an unspecified weakness vulnerability in Microsoft Edge Chromium. Its CVSS base score is 2.5 (Low).
Operationally, ranked in the top 21.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
Microsoft Edge (Chromium-based) contains a remote code execution vulnerability tracked as CVE-2022-21929. The flaw received a CVSS 3.1 score of 2.5 with the vector AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N, indicating local attack vector, high attack complexity, no privileges required, and required user interaction, resulting in limited integrity impact without confidentiality or availability effects.
An attacker would need to deliver a specially crafted input that a user opens locally in the browser; successful exploitation could allow limited modification of data on the system but would not grant full remote code execution under the stated scoring conditions.
Microsoft security advisories at the listed MSRC URLs address the issue and direct administrators to available updates for the affected Edge builds.
The associated EPSS score rose from a low baseline to a peak of 0.0625 on 2025-01-22 before receding to the current value of 0.0108, indicating a period of increased exploitation interest well after initial disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-27085
Vulnerability details
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.