CVE-2022-3075

CVE-2022-3075 is an insufficient data validation flaw (CWE-20) in Mojo, the inter-process communication layer of the Chromium browser engine, affecting Google Chrome versions prior to 105.0.5195.102. An attacker triggers it via a crafted HTML page after first compromising the browser's renderer process; the bug then allows code to escape the Chrome sandbox. Successful exploitation yields execution outside the renderer sandbox, potentially giving the attacker broader access to the host, which the 9.6 CVSS score reflects via network attack vector, user interaction, and high impact across the changed scope. All users of Google Chrome prior to 105.0.5195.102 are exposed, and Fedora, which ships Chromium-based browser packages, is also listed as affected. The flaw was confirmed as a zero-day exploited in the wild — Google's ninth actively exploited Chrome zero-day of 2022 — was added to CISA's KEV catalog on 2022-09-08, and carries a 5.8% EPSS probability of exploitation within 30 days.

What to do: Update Google Chrome to 105.0.5195.102 or later on all desktop platforms and restart the browser; verify the running version via chrome://version. Fedora users should immediately apply system updates to receive rebuilt Chromium packages. Because this flaw is in CISA's Known Exploited Vulnerabilities catalog, KEV-bound organizations (including federal agencies) must apply the vendor updates by the required deadline.