CVE-2022-3075

9.6

CRITICAL

Google Chromium Insufficient Data Validation Vulne - [Actively Exploited]

Description

Insufficient data validation in Mojo in Google Chrome prior to 105.0.5195.102 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.

INFO

Published Date :

Sept. 26, 2022, 4:15 p.m.

Last Modified :

Feb. 3, 2025, 2:15 p.m.

Source :

[email protected]

Remotely Exploitable :

Yes !

Impact Score :

6.0

Exploitability Score :

2.8

CISA Notification

CISA KEV (Known Exploited Vulnerabilities)

For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild.

Due Date: Sep 29, 2022

Alert Date: Sep 08, 2022 | 958 days ago

Description :

Google Chromium Mojo contains an insufficient data validation vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

Required Action :

Apply updates per vendor instructions.

Notes :

https://chromereleases.googleblog.com/2022/09/stable-channel-update-for-desktop.html, https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-3075; https://nvd.nist.gov/vuln/detail/CVE-2022-3075

Public PoC/Exploit Available at Github

CVE-2022-3075 has a 4 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

Affected Products

The following products are affected by CVE-2022-3075 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID	Vendor	Product
1	Fedoraproject	fedora
1	Google	chrome
1	Microsoft	edge_chromium

: Total Affected Vendor : 3 | Products : 3

References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2022-3075.

URL	Resource
https://chromereleases.googleblog.com/2022/09/stable-channel-update-for-desktop.html	Release Notes Vendor Advisory
https://crbug.com/1358134	Permissions Required
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4NMJURTG5RO3TGD7ZMIQ6Z4ZZ3SAVYE/	Broken Link
https://security.gentoo.org/glsa/202209-23	Third Party Advisory
https://chromereleases.googleblog.com/2022/09/stable-channel-update-for-desktop.html	Release Notes Vendor Advisory
https://crbug.com/1358134	Permissions Required
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4NMJURTG5RO3TGD7ZMIQ6Z4ZZ3SAVYE/	Broken Link
https://security.gentoo.org/glsa/202209-23	Third Party Advisory

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

wh1ant/vulnjs

None

Updated: 3 weeks, 4 days ago

24 stars 2 fork 2 watcher

Born at : March 10, 2025, 5:37 p.m. This repo has been linked 83 different CVEs too.

gmh5225/vulnjs

Research browsers

JavaScript HTML

Updated: 1 month, 1 week ago

0 stars 0 fork 0 watcher

Born at : March 10, 2025, 2:35 p.m. This repo has been linked 83 different CVEs too.

wh1ant/vulnjs

Research browser

JavaScript HTML

Updated: 1 year, 1 month ago

1 stars 0 fork 0 watcher

Born at : Oct. 8, 2023, 11:44 a.m. This repo has been linked 20 different CVEs too.

Ostorlab/KEV

Ostorlab KEV: One-command to detect most remotely known exploitable vulnerabilities. Sourced from CISA KEV, Google's Tsunami, Ostorlab's Asteroid and Bug Bounty programs.

cisa-kev vulnerability 0day cisa exploits

Updated: 4 days, 18 hours ago

562 stars 39 fork 39 watcher

Born at : April 19, 2022, 8:58 a.m. This repo has been linked 1270 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2022-3075 vulnerability anywhere in the article.

Daily CyberSecurity

Critical SSRF Vulnerability Patched in LNbits Lightning Wallet Server

LNbits, the modular and extendable Lightning Network wallet server, has patched a critical Server-Side Request Forgery (SSRF) vulnerability that exposed internal services to potential exploitation via ...

Published Date: Apr 10, 2025 (1 week, 6 days ago)

CVE-2024-12556 CVE-2024-48887 CVE-2025-32406 CVE-2024-54092 CVE-2025-32013 CVE-2025-30406 CVE-2025-27494 CVE-2024-43707 CVE-2024-55563 CVE-2024-43573 ...+7 more CVE

Daily CyberSecurity

High-Severity XXE Vulnerability Found in NAKIVO Backup & Replication

A high-severity security vulnerability has been identified in NAKIVO Backup & Replication, a popular data protection solution. The vulnerability, classified as an XML External Entity (XXE) issue and t ...

Published Date: Apr 10, 2025 (1 week, 6 days ago)

CVE-2024-12556 CVE-2024-48887 CVE-2025-32406 CVE-2024-54092 CVE-2025-30406 CVE-2025-27494 CVE-2024-43707 CVE-2024-43573 CVE-2024-43572 CVE-2024-40711 ...+6 more CVE

Daily CyberSecurity

Critical Vulnerabilities: CISA Alerts to Windows CLFS and Gladinet CentreStack Threats

Recently, the Cybersecurity and Infrastructure Security Agency (CISA) added two significant vulnerabilities to its Known Exploited Vulnerabilities Catalog, highlighting the urgency for users to apply ...