CVE-2022-3075

CriticalCVSS 9.6/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

Insufficient data validation in Mojo in Google Chrome prior to 105.0.5195.102 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.

Metrics

CVSS 3.1 9.6/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

VendorProductVersions
GoogleChrome>= unspecified, < 105.0.5195.102

References

Timeline

Published
Sep 26, 2022
Last modified
Jun 17, 2026
Added to CISA KEV
Sep 8, 2022
NVD status
Analyzed

Related CVEs from 2022

CVE-2022-307503.3Improper access control vulnerability in updateLastConnectedClientInfo function of SemWifiApClient prior to SMR Jul-2022 Release 1 allows atCVE-2022-307513.3Improper access control vulnerability in sendDHCPACKBroadcast function of SemWifiApClient prior to SMR Jul-2022 Release 1 allows attacker toCVE-2022-307523.3Improper access control vulnerability in sendDHCPACKBroadcast function of SemWifiApClient prior to SMR Jul-2022 Release 1 allows attacker toCVE-2022-307533.3Improper use of a unique device ID in unprotected SecSoterService prior to SMR Jul-2022 Release 1 allows local attackers to get the device ICVE-2022-307547.8Implicit Intent hijacking vulnerability in AppLinker prior to SMR Jul-2022 Release 1 allow allows attackers to launch certain activities witCVE-2022-307557.8Improper authentication vulnerability in AppLock prior to SMR Jul-2022 Release 1 allows attacker to bypass password confirm activity by hijaCVE-2022-307567.8Implicit Intent hijacking vulnerability in Finder prior to SMR Jul-2022 Release 1 allow allows attackers to launch certain activities with pCVE-2022-307573.3Improper authorization in isemtelephony prior to SMR Jul-2022 Release 1 allows attacker to obtain CID without ACCESS_FINE_LOCATION permissioCVE-2022-307585.5Implicit Intent hijacking vulnerability in Finder prior to SMR Jul-2022 Release 1 allow allows attackers to access some protected informatioCVE-2022-307598.8In Nokia One-NDS (aka Network Directory Server) through 20.9, some Sudo permissions can be exploited by some users to escalate to root priviCVE-2022-30767.2The CM Download Manager WordPress plugin before 2.8.6 allows high privilege users such as admin to upload arbitrary files by setting the anyCVE-2022-307604.3An Insecure Direct Object Reference (IDOR) issue in fn2Web in ihb eG FlexNow before 2.04.09.016 allows remote authenticated attackers to obt
CVE-2022-3075: Critical severity, CVSS 9.6 | Vulnix