CVE-2022-3075

Google Chromium Mojo Insufficient Data Validation Vulnerability

Severity Score

9.6

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

Yes

*KEV

Decision

*SSVC

Descriptions

Insufficient data validation in Mojo in Google Chrome prior to 105.0.5195.102 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.

Una comprobación insuficiente de datos en Mojo en Google Chrome versiones anteriores a 105.0.5195.102, permitía a un atacante remoto que hubiera comprometido el proceso de renderización llevar a cabo un filtrado de sandbox por medio de una página HTML diseñada.

Google Chromium Mojo contains an insufficient data validation vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

*Credits: N/A

CVSS Scores

NISTv3.1 9.6

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2022-09-01 CVE Reserved
2022-09-08 Exploited in Wild
2022-09-26 CVE Published
2022-09-29 KEV Due Date
2024-06-29 EPSS Updated
2024-08-03 CVE Updated
---------- First Exploit

CWE

CWE-20: Improper Input Validation

CAPEC

References (3)

URL	Tag	Source

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
https://chromereleases.googleblog.com/2022/09/stable-channel-update-for-desktop.html	2024-06-28
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4NMJURTG5RO3TGD7ZMIQ6Z4ZZ3SAVYE	2024-06-28
https://security.gentoo.org/glsa/202209-23	2024-06-28

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Google Search vendor "Google"		Chrome Search vendor "Google" for product "Chrome"				< 105.0.5195.102 Search vendor "Google" for product "Chrome" and version " < 105.0.5195.102"		-		Affected
Fedoraproject Search vendor "Fedoraproject"		Fedora Search vendor "Fedoraproject" for product "Fedora"				37 Search vendor "Fedoraproject" for product "Fedora" and version "37"		-		Affected