CVE-2022-2856 is a high-severity zero-day vulnerability in Google Chrome involving insufficient validation of untrusted input in the Intents feature on Android. Intents are used for deep linking within Chrome, replacing older URI schemes. Improper input validation can lead to arbitrary code execution by allowing crafted inputs to alter control flow or resource control unexpectedly. Google patched this vulnerability as part of a stable channel update addressing 11 issues, marking the fifth actively exploited zero-day patched in Chrome in 2022. Details were withheld to prevent exploitation during patch rollout. The vulnerability was reported by Google Threat Analysis Group researchers and is rated high severity by CVSS.

The vulnerability allows an attacker to execute arbitrary code on affected systems by exploiting insufficient input validation in Chrome's Intents feature on Android. This could lead to full compromise of the browser process or potentially the underlying system depending on the exploit context. The flaw was actively exploited in the wild prior to patching, increasing risk to users who had not yet updated. Since Intents handle deep linking to mobile apps, exploitation could be triggered via crafted links or web content.

Google has released an official patch addressing CVE-2022-2856 as part of a stable channel update that fixes 11 vulnerabilities. Users and administrators should apply the latest Chrome update promptly to mitigate this actively exploited zero-day. Google withheld detailed vulnerability information until the patch was widely deployed to reduce exploitation risk. No additional mitigation steps are indicated beyond applying the official update.