CVE-2022-4457: Cloudflare WARP

Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days.

Due to a misconfiguration in the manifest file of the WARP client for Android, it was possible to a perform a task hijacking attack. An attacker could create a malicious mobile application which could hijack legitimate app and steal potentially sensitive information when installed on the victim's device.

Affected products

• Cloudflare WARP: before 6.20 (fixed in 6.20)

Published 2023-01-11. Last modified 2026-06-17.