5.4Mittel
Google Chrome
Incorrect authorization in Blink in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)
9.6Kritisch
KEV
CVE-2022-3075Google Chromium Mojo Insufficient Data Validation Vulnerability
Bekannt ausgenutzt — Google Chromium Mojo Insufficient Data Validation Vulnerability
CISA hat am 08.09.2022 bestätigt, dass diese Schwachstelle in echten Angriffen genutzt wird. Frist für US-Bundesbehörden: 29.09.2022.
Erforderliche Maßnahme: Apply updates per vendor instructions. https://chromereleases.googleblog.com/2022/09/stable-channel-update-for-desktop.html, https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-3075; https://nvd.nist.gov/vuln/detail/CVE-2022-3075
Beschreibung
Insufficient data validation in Mojo in Google Chrome prior to 105.0.5195.102 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
Schwachstellentyp (CWE):
CWE-20
Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.
Betroffene Produkte und Versionen
| Hersteller | Produkt | Versionen | |
|---|---|---|---|
| fedoraproject | fedora | 37 | |
| Chrome | unspecified – < 105.0.5195.102 |
Referenzen und Patches
- https://crbug.com/1358134
- https://chromereleases.googleblog.com/2022/09/stable-channel-update-for-desktop.html Release NotesVendor Advisory
- GLSA-202209-23 vendor-advisoryThird Party Advisory
- FEDORA-2022-3f28aa88cf vendor-advisoryThird Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-3075 US Government Resource
CPE-Treffer (NVD) (2)
cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*< 105.0.5195.102cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*