# CVE-2022-0337 System environment variables leak on Google Chrome, Microsoft Edge and Opera

Chromium's showSaveFilePicker expanded %VAR% in suggestedName on Windows, leaking system environment variables like AWS keys and tokens to a malicious page.

- Payout: $10,000
- Severity: high
- Program: Google, Microsoft, Opera
- Credited: Maciej Pulikowski
- Disclosed: 2022-03-19
- CVE: CVE-2022-0337
- Write-up quality: 7/10
- Original: https://github.com/Puliczek/CVE-2022-0337-PoC-Google-Chrome-Microsoft-Edge-Opera
- Library page: https://bugbountylibrary.com/r/blog%3Agithub-com-puliczek-cve-2022-0337-poc-google-chrome-microsoft-edge-opera
- Tags: domain:browser impact:data-leak kind:bounty platform:blog sev:high tech:chromium tech:windows technique:source-review vuln:info-disclosure vuln:secrets-leak

**Target:** Chromium File System Access API (window.showSaveFilePicker) on Windows
**Root cause:** The suggestedName parameter of showSaveFilePicker was passed to Windows file-dialog APIs that perform environment-variable expansion, so %VAR% tokens in the filename were resolved to real env var values and returned via the FileSystemFileHandle name.
**Steps:**
1. Open DevTools on a vulnerable Chrome (92-96) on Windows.
2. Run `let a = await window.showSaveFilePicker({suggestedName:'%username%'}); a.name;`
3. Accept the save dialog; the returned handle name reveals the expanded username.
4. Repeat with `%AWS_SECRET_ACCESS_KEY%`, `%GITHUB_TOKEN%`, `%AZURE_CLIENT_SECRET%`, `%binance_secret%` to exfiltrate secrets.
5. For remote attack, host env.html that calls showSaveFilePicker and instructs the victim to hold ENTER for 2 seconds so the default-focused Save button is accepted.
**How found:** Researcher hypothesized that the suggestedName string reaches OS-level filename handling and tested Windows-style %VAR% expansion syntax in the save picker, observing the returned name contained the resolved value.
**Exploitation:** Attacker hosts a page that calls showSaveFilePicker with suggestedName containing %SECRET% tokens; the Windows save dialog expands them and the resulting filename is read back via handle.name, exfiltrating env-var secrets (cloud keys, tokens) to the attacker.
**Insight:** When an API passes user-controlled strings into OS file dialogs or path resolution, test platform-specific expansion syntax (%VAR% on Windows, $VAR/${VAR} on shells) since the OS may resolve them before the app sees the result.