CVE-2022-3075
Google Chromium Mojo Insufficient Data Validation Vulnerability
Description
CVE-2022-3075 is an insufficient data validation vulnerability in Google Chromium's Mojo component that allows a remote attacker who has already compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. This vulnerability affects multiple Chromium-based browsers including Google Chrome, Microsoft Edge, and Opera. CISA added CVE-2022-3075 to the KEV catalog on September 8, 2022. The EPSS score of 2.12% (83.92nd percentile) indicates moderate exploitation probability.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| chrome | < 105.0.5195.102 | |
| fedoraproject | fedora | 37 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
References
- https://chromereleases.googleblog.com/2022/09/stable-channel-update-for-desktop.html(Release Notes, Vendor Advisory)
- https://crbug.com/1358134(Permissions Required)
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4NMJURTG5RO3TGD7ZMIQ6Z4ZZ3SAVYE/(Third Party Advisory)
- https://security.gentoo.org/glsa/202209-23(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-3075(US Government Resource)
Weakness Type
CWE-20: Improper Input Validation
CVE-2022-3075 is an insufficient data validation vulnerability in Chromium's Mojo inter-process communication system. The Mojo component fails to adequately validate data passed between browser processes, allowing an attacker who has compromised the renderer to escape the browser sandbox.
Learn more: CWE-20 — Improper Input Validation
Impact Analysis
CVE-2022-3075 enables sandbox escape from the Chromium renderer process, which is a critical security boundary in all Chromium-based browsers. While exploitation requires first compromising the renderer process (typically through a separate vulnerability), a successful sandbox escape escalates the attack from isolated web content processing to full system access. Confidentiality, integrity, and availability are all impacted once the sandbox is escaped, as the attacker gains access to the user's system with the browser's privilege level. The broad impact across multiple Chromium-based browsers (Chrome, Edge, Opera, Brave) amplifies the vulnerability's significance.
Exploit Maturity
CISA confirmed active exploitation of CVE-2022-3075 and added it to the KEV catalog on September 8, 2022, with a remediation deadline of September 29, 2022. Google acknowledged that an exploit for this vulnerability exists in the wild. The EPSS score of 2.12% (83.92nd percentile) indicates moderate exploitation probability. As a sandbox escape, this vulnerability would typically be chained with a renderer compromise vulnerability for a complete attack. The ransomware association is classified as unknown.
Remediation
- Update Chromium-based browsers: Update Google Chrome to version 105.0.5195.102 or later, Microsoft Edge to the corresponding patched version, and all other Chromium-based browsers to their latest releases.
- Enable automatic browser updates: Configure browser update policies to ensure automatic updates are applied promptly.
- Deploy browser management policies: Use enterprise browser management to verify and enforce minimum browser version requirements across the organization.
- Implement browser isolation: Consider using browser isolation technologies for high-risk browsing activities to provide an additional security layer beyond the browser sandbox.
- Monitor for exploitation indicators: Watch for unusual browser process behavior, unexpected child processes spawned by browsers, and other signs of sandbox escape.
Technical Details
CVE-2022-3075 targets the Mojo component in Chromium, which is the inter-process communication (IPC) framework used for communication between the browser's sandboxed renderer processes and the privileged browser process. The insufficient data validation in Mojo means that a compromised renderer process can send specially crafted IPC messages that are not properly validated by the receiving browser process. This allows the attacker to influence the privileged process's behavior and escape the renderer sandbox. Chromium's multi-process architecture relies on the sandbox as a critical security boundary — the renderer processes handle untrusted web content in a restricted environment, while the browser process has full system access. A sandbox escape via Mojo bridges this gap.
Frequently Asked Questions
Is CVE-2022-3075 being actively exploited?
Yes, Google confirmed that an exploit for CVE-2022-3075 exists in the wild. CISA added it to the KEV catalog on September 8, 2022.
What products are affected by CVE-2022-3075?
CVE-2022-3075 affects Google Chrome, Microsoft Edge, Opera, Brave, and all other Chromium-based browsers prior to their patched versions.
How do I fix CVE-2022-3075?
Update all Chromium-based browsers to the latest version. Chrome should be updated to version 105.0.5195.102 or later.
How severe is CVE-2022-3075?
CVE-2022-3075 is a high-severity sandbox escape vulnerability with an EPSS score of 2.12% (83.92nd percentile). It allows attackers to break out of the browser sandbox, potentially leading to full system compromise.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.