CVE-2022-3075VulnerabilityPublished 09/08/2022Updated 10/24/2026
CVE-2022-3075: Google Chromium Mojo Insufficient Data Validation Vulnerability
Affects Google Chromium MojoSource CISA KEV
Severity
HighNo CVSS score published yet
- Exploitation
Actively exploited – in CISA KEV since 09/08/2022
- KEV deadline
- 09/29/2022
- EPSS
- 5.8% chance of exploitation in 30 days – higher than 93% of CVEs
What to do
Description
Google Chromium Mojo contains an insufficient data validation vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Weaknesses
References
- chromereleases.googleblog.com/2022/09/stable-channel-update-for-desktop.html, (opens in a new tab)
- msrc.microsoft.com/update-guide/vulnerability/CVE-2022-3075 (opens in a new tab)
- nvd.nist.gov/vuln/detail/CVE-2022-3075 (opens in a new tab)
- cisa.gov/known-exploited-vulnerabilities-catalog?search=CVE-2022-3075 (opens in a new tab)