CVE-2022-3075 Google Chromium Mojo Insufficient Data Validation

Exploited in the wild Critical 9.6 Published 26 Sep 2022 Updated 21 Oct 2025

A remote attacker with compromised renderer access can escape the sandbox via a crafted HTML page due to insufficient data validation in Mojo.

Exploited in the wild: Since 8 Sep 2022
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2022-3075?

CVE-2022-3075 is a critical vulnerability in Fedoraproject Fedora, published on 26 Sep 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Insufficient data validation in Mojo in Google Chrome prior to 105.0.5195.102 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.

Weakness: CWE-20

Which versions are affected by CVE-2022-3075?

It affects 2 products.

Linux distribution packages (4)

`opera` openSUSE:Leap 15.3 NonFree	All versions	`90.0.4480.84-lp153.2.60.1`
`opera` openSUSE:Leap 15.4 NonFree	All versions	`90.0.4480.84-lp154.2.20.1`
`opera` openSUSE:Leap 15.5 NonFree	All versions	`90.0.4480.84-lp155.3.3.1`
`nodejs-electron` openSUSE:Tumbleweed	All versions	`19.0.17-1.1`

Products include Fedoraproject Fedora, Google Chrome.

How do I fix CVE-2022-3075?

Upgrade to a fixed version. US federal agencies must fix it by 29 Sep 2022.

Is CVE-2022-3075 being exploited?

Yes. Attackers have exploited CVE-2022-3075 in the wild since at least 8 Sep 2022.

All Fedoraproject Fedora vulnerabilities

Sources

Also known as DEBIAN-CVE-2022-3075, DSA-5225-1, GHSA-7ch3-c534-49jq, UBUNTU-CVE-2022-3075, openSUSE-SU-2022:10117-1, openSUSE-SU-2022:10118-1 and 2 more.