CVE-2022-3075: Google Chrome Mojo insufficient validation allows sandbox escape

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityCVSS 9.6 with a sandbox escape, active inclusion in CISA KEV, and a high EPSS percentile make this a top remediation priority.

What it is

Google Chrome before 105.0.5195.102 has insufficient data validation in Mojo, the IPC layer between browser processes. An attacker who has already compromised the renderer process can use a crafted HTML page to break out of the browser sandbox. Because the sandbox is the main containment boundary for Chrome, a bypass exposes the underlying operating system to the attacker.

Impact

An attacker gains code execution outside the Chrome sandbox, at the privilege level of the browser process, on the victim's machine. This turns a renderer compromise into a full host compromise.

Attack surface

Reached over the network via a crafted HTML page rendered in Chrome; the CVSS vector requires user interaction (UI:R) and no privileges (PR:N), but the description states the attacker must already have compromised the renderer process. No authentication is needed.

Exploitation

CVE-2022-3075 is listed in CISA KEV with a 2022-09-29 remediation due date, indicating known exploitation in the wild. EPSS 30-day probability is 0.05759 (92.69th percentile), and no ransomware use is documented.

What to do

• Update Chrome to 105.0.5195.102 or later, and apply the corresponding Fedora and Gentoo Chromium updates.
• Enforce automatic browser updates and verify installed versions across endpoints.
• Restrict or isolate browsing of untrusted web content, and keep renderer sandboxing enabled.
• Monitor for and remove unexpected browser extensions or processes that could aid renderer compromise.
• Treat any confirmed renderer compromise as a potential host compromise and isolate the endpoint.

Detection

• Hunt for Chrome versions below 105.0.5195.102 in asset inventory and endpoint telemetry.
• Monitor for Chrome child processes spawning unexpected executables or making unusual network connections.
• Review proxy and DNS logs for known exploit-delivery domains tied to Chrome zero-day campaigns.
• Alert on sandbox-related crash or IPC anomaly telemetry from Chrome renderer processes.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.