CVE-2022-29580

Path Traversal in Android Google Search App

State: Published
Severity: 8.9 High
Published: Dec 13, 2022
Updated: Apr 18, 2025
Reserved: Apr 22, 2022

Description

There exists a path traversal vulnerability in the Android Google Search app. This is caused by the incorrect usage of uri.getLastPathSegment. A symbolic encoded string can bypass the path logic to get access to unintended directories. An attacker can manipulate paths that could lead to code execution on the device. We recommend upgrading beyond version 13.41

Scores

CVSS	Score	Vector	Source
3.1	8.9 High	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L	Google

Weaknesses

CWE-427 Uncontrolled Search Path Element

Affected Products

Product	Versions
Android Google Search AppGoogle	10.61 through 13.41Affected

References

https://support.google.com/faqs/answer/7496913?hl=en

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.