CVE-2022-3075
Google Chromium Mojo Insufficient Data Validation Vulnerability
Published Sep 8, 2022 · updated Jun 16, 2026 · google chrome
Google Chromium Mojo contains an insufficient data validation vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Timeline
Detection, updates, and resolution for this record.
Sep 8, 2022 · Catalog
Detected
Google Chromium Mojo contains an insufficient data validation vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Sep 8, 2022 · CISA KEV
Known exploited
Apply updates per vendor instructions.
Sep 29, 2022 · CISA KEV
Remediation due
Apply updates per vendor instructions.
Jun 16, 2026 · Catalog
Updated
Google Chromium Mojo contains an insufficient data validation vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Required action
Apply updates per vendor instructions.
CISA due date Sep 29, 2022
Affected
- cpe fedoraproject/fedora37
- cpe google/chromeversion unspecified
- vendor Google Chromium Mojoversion unspecified
Sources
- CISA KEVCVE-2022-3075
Google Chromium Mojo contains an insufficient data validation vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
cisa.gov - CVE.orgCVE-2022-3075
Official CVE identifier
cve.org - FIRST EPSSCVE-2022-3075
30-day exploitation probability 5.8%
first.org - NIST NVDCVE-2022-3075
Insufficient data validation in Mojo in Google Chrome prior to 105.0.5195.102 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
nvd.nist.gov