Input validation error in Google Chrome - CVE-2022-3075

Vulnerability identifier: #VU66953

CSH Severity: Critical

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-3075

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: The vulnerability is being exploited in the wild

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to insufficient validation of user-supplied input within the Mojo component in Google Chrome. A remote attacker can trick the victim into visiting a specially crafted website and execute arbitrary code on the system.

Note, the vulnerability is being actively exploited in the wild.

Google Chrome
Microsoft Edge
Gentoo Linux
Debian Linux
Fedora
Chrome OS
www-client/microsoft-edge
chromium (Debian package)
www-client/chromium
www-client/chromium-bin
www-client/google-chrome
chromium

Install updates from vendor's website.

Google Chrome - update to 105.0.5195.102
Microsoft Edge - update to 105.0.1343.27
Chrome OS - update to 102.0.5005.177
www-client/microsoft-edge - update to 105.0.1343.42
chromium (Debian package) - update to 105.0.5195.102-1~deb11u1
www-client/chromium - update to 105.0.5195.125
www-client/chromium-bin - update to 105.0.5195.125
www-client/google-chrome - update to 105.0.5195.125
chromium - addressed in versions 105.0.5195.125-2.el8, 105.0.5195.125-2.el9, 105.0.5195.125-2.fc35, 105.0.5195.125-2.fc36, 105.0.5195.125-2.fc37

• https://chromereleases.googleblog.com/2022/09/stable-channel-update-for-desktop.html
• https://crbug.com/1358134

• Remote code execution in Google Chrome
• Remote code execution in Microsoft Edge
• Debian update for chromium
• Multiple vulnerabilities in Chrome OS LTS
• Gentoo update for Chromium, Google Chrome, Microsoft Edge
• Fedora 36 update for chromium
• Fedora 35 update for chromium
• Fedora 37 update for chromium
• Fedora EPEL 8 update for chromium
• Fedora EPEL 9 update for chromium