GHSA-j44q-wmqr-v226

GHSA-j44q-wmqr-v226 PUBLISHED CVSS 6.5 MEDIUM

Record from GitHub Advisory Database · Published May 13, 2022

Incorrect handling of a confusable character in Omnibox in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted domain name.

Risk scores

CVSS 3.0

6.5

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Timeline

May 13, 2022 CVE Published
Apr 9, 2026 Distribution Patch (2 in total, the first dated here)
Apr 30, 2026 Security Advisory

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln GHSA-j44q-wmqr-v226
vulnetix vdb fixes GHSA-j44q-wmqr-v226

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/GHSA-j44q-wmqr-v226/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

https://nvd.nist.gov/vuln/detail/CVE-2019-5775 advisory
https://access.redhat.com/errata/RHSA-2019:0309 url
https://chromereleases.googleblog.com/2019/01/stable-channel-update-for-desktop.html url
http://www.securityfocus.com/bid/106767 url
https://crbug.com/896722 url
https://www.debian.org/security/2019/dsa-4395 url
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JVFHYCJGMZQUKYSIE2BXE4NLEGFGUXU5 url
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZQOP53LXXPRGD4N5OBKGQTSMFXT32LF6 url

Look up in the Resolve Platform →