Skip to content
OpenAdvisories
High MSRC-CVE-2022-24522 1 CVE

Skype Extension for Chrome Information Disclosure Vulnerability

Published Mar 8, 2022 · Updated May 16, 2022 · Revision 2

Vendor: Microsoft

Summary

Impact: Information Disclosure. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

Details

How can I get the update for Skype Extension for Chrome?
The Skype Extension for Chrome is available in the Chrome Web Store.
Open the Chrome Web Store and type "Skype" into the search box.
Scroll down to Extensions. The Skype Extension will be the first on the list
Click on the Add to Chrome button.

What type of information could be disclosed by this vulnerability?
The type of information that could be disclosed if an attacker successfully exploited this vulnerability is the target's Skype ID. If an attacker gains access to that ID they could potentially match it within Skype to a name and Avatar for the user.

According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do?
A targeted user would need to visit a malicious user's website using Chrome with this Extension while the user is logged into a Microsoft account.

Security updates
10.2.0.9951 — https://chrome.google.com/webstore/detail/skype/lifbcibllhkdhoafpjfnlhfpfgnpldfl

Vulnerabilities 1

Revision history

  1. #2

    Updated one or more CVSS scores for the affected products. This is an informational change only.

  2. #1

    Information published.

References