Actively exploited · Published Sep 26, 2022 · Assigned by Chrome
CVE-2022-3075
Critical 9.6 Exploited
In plain English
A critical-severity security flaw in Chrome from Google. Attackers are actively exploiting it in the wild (listed by CISA on September 8, 2022). The chance it is exploited in the next 30 days is estimated at 5.8% (higher than 93% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)9.6Critical
Exploit odds (30 days)5.8%top 6.9% of all CVEs
Exploited in the wildYesCISA KEV since Sep 8, 2022
Attack toolingNoneno public tooling known
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by Sep 29, 2022.
Official description
Insufficient data validation in Mojo in Google Chrome prior to 105.0.5195.102 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | qt5-qtwebengine | 5.15.11-r3 | ALPINE-CVE-2022-3075 |
| Alpine:v3.21 | qt5-qtwebengine | 5.15.11-r3 | ALPINE-CVE-2022-3075 |
| Alpine:v3.22 | qt5-qtwebengine | 5.15.11-r3 | ALPINE-CVE-2022-3075 |
| Alpine:v3.23 | qt5-qtwebengine | 5.15.11-r3 | ALPINE-CVE-2022-3075 |
| Debian:12 | chromium | 105.0.5195.102-1 | DEBIAN-CVE-2022-3075 |
| Debian:13 | chromium | 105.0.5195.102-1 | DEBIAN-CVE-2022-3075 |
| Debian:14 | chromium | 105.0.5195.102-1 | DEBIAN-CVE-2022-3075 |
Affected products (as reported)
References
- https://crbug.com/1358134 x_refsource_MISC
- https://chromereleases.googleblog.com/2022/09/stable-channel-update-for-desktop.html x_refsource_MISC
- GLSA-202209-23 vendor-advisory, x_refsource_GENTOO
- FEDORA-2022-3f28aa88cf vendor-advisory, x_refsource_FEDORA
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-3075 government-resource