CVE-2022-3075: critical vulnerability in Google Chrome
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA.
Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.
Apply updates per vendor instructions.
A flaw in Google Chrome's Mojo system allowed attackers who compromised the browser's renderer to escape the security sandbox and access the full system. This is dangerous because the sandbox normally blocks malicious code from doing serious damage.
Insufficient input validation in Mojo before Chrome 105.0.5195.102 enabled sandbox escape when an attacker with renderer process compromise could craft a malicious HTML page to trigger the vulnerability. Attack requires prior renderer compromise; impact is critical as it breaks the isolation boundary protecting the system from browser-based exploits.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.