Insufficient validation of untrusted inputĬhrome has a user base of over 2.65 billion and approximately 64% of the market share. Details of the six zero-day vulnerabilities found in Chrome in 2022 are given below: However, it is the sixth zero-day vulnerability, i.e., whose exploit is available in-the-wild.

The discovery of CVE-2022-3075 comes on the heels of an update (version 105) released in the last week of August, wherein 24 security issues were addressed Opens a new window, none of which were described as zero-days, though one was critical and eight others were rated high in severity. See More: August Patch Tuesday: Microsoft Fixes Two Zero-Day and 17 Critical Vulnerabilities We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven’t yet fixed,” Google noted. “Access to bug details and links may be kept restricted until a majority of users are updated with a fix. To see if you are updated, go to the vertical ellipsis in the top right corner of Chrome, and click on Settings > About Chrome.Īfter installing the update, the stable build should be 1.102. By now, the update should be available for most regions. In other words, a threat actor can exploit the bug by feeding a malicious input.įix for the zero-day vulnerability, whose exploit “exists in the wild,” will be released in the coming days/week, according to Google’s post dated September 2, 2022. Google credited an anonymous researcher with discovering CVE-2022-3075, which from the information revealed by Google so far, exists due to gaps in how Chrome is fed inputs for validation. These libraries, collectively known as Mojo, enable Chrome or any other app/program that runs on it for multiple functions, mainly to carry out inter- and intra-process communication. Without going into details of the vulnerability for obvious reasons, Google said CVE-2022-3075 exists due to “insufficient data validation” in the runtime libraries that Chromium, the open-source browser Chrome is based on. Google issued the update for the desktop versions of the browser, including Windows, Mac, and Linux. Tracked as CVE-2022-3075, the vulnerability is the sixth zero-day one found in the popular browser. Google recently rolled out an update for a new zero-day vulnerability found in the Chrome web browser.

Chrome what new