Every CVE Search/ Get API key

CVE-2022-3045

Insufficient validation of untrusted input in V8 in Google Chrome prior to 105.0.5195.52 allowed...

8.8 HighFix available

Insufficient validation of untrusted input in V8 in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

1.16%Up 0.1 points since Sep 27, 2022
90%50%10%1%

What each source reports

NVD Score used 8.8

Insufficient validation of untrusted input in V8 in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Record
CVE-2022-3045
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-787
Updated
2026-11-02
CVE List 8.8

Insufficient validation of untrusted input in V8 in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Record
CVE-2022-3045
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-787
Updated
2026-11-02
EUVDEUVD-2022-42477 8.8

Insufficient validation of untrusted input in V8 in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Record
EUVD-2022-42477
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-2cv3-9jp8-rgg3 8.8

Insufficient validation of untrusted input in V8 in Google Chrome prior to 105.0.5195.52 allowed...

Insufficient validation of untrusted input in V8 in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Record
GHSA-2cv3-9jp8-rgg3
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-787, CWE-863
Updated
2026-11-02
OSV 8.8

Insufficient validation of untrusted input in V8 in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Record
CVE-2022-3045
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2022-3045 8.8

Insufficient validation of untrusted input in V8 in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Record
UBUNTU-CVE-2022-3045
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 6 moreShow less
OSVDEBIAN-CVE-2022-3045 No score

Insufficient validation of untrusted input in V8 in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Record
DEBIAN-CVE-2022-3045
Updated
2026-11-03
OSVMGASA-2022-0318 No score

Updated chromium-browser-stable packages fix security vulnerability

The chromium-browser-stable package has been updated to the new 105 branch with the 105.0.5195.102 version, fixing many bugs and 25 vulnerabilities.

Google is aware of reports that an exploit for CVE-2022-3075 exists in the wild. Some of the addressed CVE are listed below:

High CVE-2022-3075: Insufficient data validation in Mojo. Reported by Anonymous on 2022-08-30

Critical CVE-2022-3038: Use after free in Network Service. Reported by Sergei Glazunov of Google Project Zero on 2022-06-28

High CVE-2022-3039: Use after free in WebSQL. Reported by Nan Wang(@eternalsakura13) and Guang Gong of 360 Vulnerability Research Institute on 2022-07-11

High CVE-2022-3040: Use after free in Layout. Reported by Anonymous on 2022-07-03

High CVE-2022-3041: Use after free in WebSQL. Reported by Ziling Chen and Nan Wang(@eternalsakura13) of 360 Vulnerability Research Institute on 2022-07-20

High CVE-2022-3042: Use after free in PhoneHub. Reported by koocola(@alo_cook) and Guang Gong of 360 Vulnerability Research Institute on 2022-06-22

High CVE-2022-3043: Heap buffer overflow in Screen Capture. Reported by @ginggilBesel on 2022-06-16

High CVE-2022-3044: Inappropriate implementation in Site Isolation. Reported by Lucas Pinheiro, Microsoft Browser Vulnerability Research on 2020-02-12

High CVE-2022-3045: Insufficient validation of untrusted input in V8. Reported by Ben Noordhuis [email protected] on 2022-06-26

High CVE-2022-3046: Use after free in Browser Tag. Reported by Rong Jian of VRI on 2022-07-21

High CVE-2022-3071: Use after free in Tab Strip. Reported by @ginggilBesel on 2022-06-06

Medium CVE-2022-3047: Insufficient policy enforcement in Extensions API. Reported by Maurice Dauer on 2022-07-07

Medium CVE-2022-3048: Inappropriate implementation in Chrome OS lockscreen. Reported by Andr.Ess on 2022-03-06

Medium CVE-2022-3049: Use after free in SplitScreen. Reported by @ginggilBesel on 2022-04-17

Medium CVE-2022-3050: Heap buffer overflow in WebUI. Reported by Zhihua Yao of KunLun Lab on 2022-06-17

Medium CVE-2022-3051: Heap buffer overflow in Exosphere. Reported by @ginggilBesel on 2022-07-18

Medium CVE-2022-3052: Heap buffer overflow in Window Manager. Reported by Khalil Zhani on 2022-07-21

Medium CVE-2022-3053: Inappropriate implementation in Pointer Lock. Reported by Jesper van den Ende (Pelican Party Studios) on 2021-11-08

Medium CVE-2022-3054: Insufficient policy enforcement in DevTools. Reported by Kuilin Li on 2022-01-24

Medium CVE-2022-3055: Use after free in Passwords. Reported by Weipeng Jiang (@Krace) and Guang Gong of 360 Vulnerability Research Institute on 2022-08-11

Low CVE-2022-3056: Insufficient policy enforcement in Content Security Policy. Reported by Anonymous on 2022-05-26

Low CVE-2022-3057: Inappropriate implementation in iframe Sandbox. Reported by Gareth Heyes on 2022-06-16

Low CVE-2022-3058: Use after free in Sign-In Flow. Reported by raven at KunLun lab on 2022-06-20

Record
MGASA-2022-0318
Updated
2026-11-02
OSVopenSUSE-SU-2022:10119-1 No score

Security update for chromium

This update for chromium fixes the following issues:

Chromium 105.0.5195.102 (boo#1203102):

  • CVE-2022-3075: Insufficient data validation in Mojo

Chromium 105.0.5195.52 (boo#1202964):

  • CVE-2022-3038: Use after free in Network Service
  • CVE-2022-3039: Use after free in WebSQL
  • CVE-2022-3040: Use after free in Layout
  • CVE-2022-3041: Use after free in WebSQL
  • CVE-2022-3042: Use after free in PhoneHub
  • CVE-2022-3043: Heap buffer overflow in Screen Capture
  • CVE-2022-3044: Inappropriate implementation in Site Isolation
  • CVE-2022-3045: Insufficient validation of untrusted input in V8
  • CVE-2022-3046: Use after free in Browser Tag
  • CVE-2022-3071: Use after free in Tab Strip
  • CVE-2022-3047: Insufficient policy enforcement in Extensions API
  • CVE-2022-3048: Inappropriate implementation in Chrome OS lockscreen
  • CVE-2022-3049: Use after free in SplitScreen
  • CVE-2022-3050: Heap buffer overflow in WebUI
  • CVE-2022-3051: Heap buffer overflow in Exosphere
  • CVE-2022-3052: Heap buffer overflow in Window Manager
  • CVE-2022-3053: Inappropriate implementation in Pointer Lock
  • CVE-2022-3054: Insufficient policy enforcement in DevTools
  • CVE-2022-3055: Use after free in Passwords
  • CVE-2022-3056: Insufficient policy enforcement in Content Security Policy
  • CVE-2022-3057: Inappropriate implementation in iframe Sandbox
  • CVE-2022-3058: Use after free in Sign-In Flow

  • Update chromium-symbolic.svg: this fixes boo#1202403.

  • Fix quoting in chrome-wrapper, don't put cwd on LD_LIBRARY_PATH

Record
openSUSE-SU-2022:10119-1
Updated
2026-11-02
OSVopenSUSE-SU-2022:10120-1 No score

Security update for chromium

This update for chromium fixes the following issues:

Chromium 105.0.5195.102 (boo#1203102):

  • CVE-2022-3075: Insufficient data validation in Mojo

Chromium 105.0.5195.52 (boo#1202964):

  • CVE-2022-3038: Use after free in Network Service
  • CVE-2022-3039: Use after free in WebSQL
  • CVE-2022-3040: Use after free in Layout
  • CVE-2022-3041: Use after free in WebSQL
  • CVE-2022-3042: Use after free in PhoneHub
  • CVE-2022-3043: Heap buffer overflow in Screen Capture
  • CVE-2022-3044: Inappropriate implementation in Site Isolation
  • CVE-2022-3045: Insufficient validation of untrusted input in V8
  • CVE-2022-3046: Use after free in Browser Tag
  • CVE-2022-3071: Use after free in Tab Strip
  • CVE-2022-3047: Insufficient policy enforcement in Extensions API
  • CVE-2022-3048: Inappropriate implementation in Chrome OS lockscreen
  • CVE-2022-3049: Use after free in SplitScreen
  • CVE-2022-3050: Heap buffer overflow in WebUI
  • CVE-2022-3051: Heap buffer overflow in Exosphere
  • CVE-2022-3052: Heap buffer overflow in Window Manager
  • CVE-2022-3053: Inappropriate implementation in Pointer Lock
  • CVE-2022-3054: Insufficient policy enforcement in DevTools
  • CVE-2022-3055: Use after free in Passwords
  • CVE-2022-3056: Insufficient policy enforcement in Content Security Policy
  • CVE-2022-3057: Inappropriate implementation in iframe Sandbox
  • CVE-2022-3058: Use after free in Sign-In Flow
  • Update chromium-symbolic.svg: this fixes boo#1202403.
  • Fix quoting in chrome-wrapper, don't put cwd on LD_LIBRARY_PATH
Record
openSUSE-SU-2022:10120-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:12319-1 No score

chromedriver-105.0.5195.102-1.1 on GA media

These are all security issues fixed in the chromedriver-105.0.5195.102-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:12319-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:12948-1 No score

ungoogled-chromium-113.0.5672.92-1.1 on GA media

These are all security issues fixed in the ungoogled-chromium-113.0.5672.92-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:12948-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
chromium
Debian:12
 before 105.0.5195.52-1
105.0.5195.52-1
chromium
Debian:13
 before 105.0.5195.52-1
105.0.5195.52-1
chromium
Debian:14
 before 105.0.5195.52-1
105.0.5195.52-1
chromium
Debian:11
From an advisory covering 24 CVEs
 before 105.0.5195.52-1~deb11u1, plus listed versions
100.0.4896.127-1100.0.4896.127-1~deb11u1100.0.4896.60-1100.0.4896.60-1~deb11u1100.0.4896.75-1
Show 42 moreShow less
100.0.4896.75-1~deb11u1100.0.4896.88-1100.0.4896.88-1~deb11u1101.0.4951.41-1101.0.4951.41-1~deb11u1101.0.4951.41-2101.0.4951.54-1101.0.4951.64-1101.0.4951.64-1~deb11u1102.0.5005.115-1102.0.5005.115-1~deb11u1102.0.5005.61-1102.0.5005.61-1~deb11u1103.0.5060.114-1103.0.5060.114-1~deb11u1103.0.5060.134-1103.0.5060.134-1~deb11u1103.0.5060.53-1103.0.5060.53-1~deb11u1104.0.5112.101-1104.0.5112.101-1~deb11u1104.0.5112.79-1104.0.5112.79-1~deb11u190.0.4430.212-193.0.4577.82-197.0.4692.71-0.197.0.4692.71-0.1~deb11u197.0.4692.99-197.0.4692.99-1~deb11u197.0.4692.99-1~deb11u298.0.4758.102-198.0.4758.102-1~deb11u198.0.4758.80-198.0.4758.80-1~deb11u199.0.4818.0-0.199.0.4844.51-199.0.4844.51-1~deb11u199.0.4844.51-299.0.4844.74-199.0.4844.74-1~deb11u199.0.4844.84-199.0.4844.84-1~deb11u1
105.0.5195.52-1~deb11u1
chromium-browser-stable
Mageia:8
From an advisory covering 23 CVEs
 before 105.0.5195.102-1.mga8
105.0.5195.102-1.mga8
chromium-browser
Ubuntu:18.04:LTS
 before 105.0.5195.102-0ubuntu0.18.04.1, plus listed versions
61.0.3163.100-0ubuntu1.137862.0.3202.62-0ubuntu0.17.10.138062.0.3202.89-0ubuntu1.138662.0.3202.94-0ubuntu1.138863.0.3239.84-0ubuntu1
Show 45 moreShow less
63.0.3239.108-0ubuntu164.0.3282.119-0ubuntu164.0.3282.140-0ubuntu164.0.3282.167-0ubuntu165.0.3325.146-0ubuntu165.0.3325.181-0ubuntu166.0.3359.139-0ubuntu0.18.04.366.0.3359.181-0ubuntu0.18.04.167.0.3396.99-0ubuntu0.18.04.168.0.3440.75-0ubuntu0.18.04.168.0.3440.106-0ubuntu0.18.04.169.0.3497.81-0ubuntu0.18.04.170.0.3538.67-0ubuntu0.18.04.170.0.3538.77-0ubuntu0.18.04.170.0.3538.110-0ubuntu0.18.04.171.0.3578.80-0ubuntu0.18.04.171.0.3578.98-0ubuntu0.18.04.172.0.3626.119-0ubuntu0.18.04.172.0.3626.121-0ubuntu0.18.04.173.0.3683.75-0ubuntu0.18.04.173.0.3683.86-0ubuntu0.18.04.174.0.3729.169-0ubuntu0.18.04.175.0.3770.90-0ubuntu0.18.04.175.0.3770.142-0ubuntu0.18.04.176.0.3809.87-0ubuntu0.18.04.176.0.3809.100-0ubuntu0.18.04.177.0.3865.90-0ubuntu0.18.04.178.0.3904.70-0ubuntu0.18.04.278.0.3904.97-0ubuntu0.18.04.178.0.3904.108-0ubuntu0.18.04.179.0.3945.79-0ubuntu0.18.04.179.0.3945.130-0ubuntu0.18.04.180.0.3987.87-0ubuntu0.18.04.180.0.3987.149-0ubuntu0.18.04.180.0.3987.163-0ubuntu0.18.04.181.0.4044.122-0ubuntu0.18.04.181.0.4044.138-0ubuntu0.18.04.183.0.4103.61-0ubuntu0.18.04.184.0.4147.105-0ubuntu0.18.04.185.0.4183.83-0ubuntu0.18.04.285.0.4183.121-0ubuntu0.18.04.186.0.4240.75-0ubuntu0.18.04.186.0.4240.198-0ubuntu0.18.04.187.0.4280.66-0ubuntu0.18.04.189.0.4389.82-0ubuntu0.18.04.1
105.0.5195.102-0ubuntu0.18.04.1
chromium
SUSE:Package Hub 15 SP4
From an advisory covering 23 CVEs
 before 105.0.5195.102-bp154.2.26.1
105.0.5195.102-bp154.2.26.1
chromium
openSUSE:Leap 15.4
From an advisory covering 23 CVEs
 before 105.0.5195.102-bp154.2.26.1
105.0.5195.102-bp154.2.26.1
chromium
SUSE:Package Hub 15 SP3
From an advisory covering 23 CVEs
 before 105.0.5195.102-bp153.2.119.1
105.0.5195.102-bp153.2.119.1
chromium
openSUSE:Leap 15.3
From an advisory covering 23 CVEs
 before 105.0.5195.102-bp153.2.119.1
105.0.5195.102-bp153.2.119.1
chromium
openSUSE:Tumbleweed
From an advisory covering 23 CVEs
 before 105.0.5195.102-1.1
105.0.5195.102-1.1
chromium
openSUSE:Tumbleweed
From an advisory covering 2310 CVEs
 before 113.0.5672.92-1.1
113.0.5672.92-1.1

History

History
RecordedChangedSources
affected, factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-3045 is a high vulnerability (CVSS 8.8) in Google Chrome, published September 1, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.16%, the 67th percentile. Fixed in chromium 105.0.5195.52-1.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 17 versions and 2,130 references. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open