CVE-2022-3054 is a medium-severity vulnerability affecting Google Chrome and Fedora-based Chrome browsers prior to version 105.0.5195.52. It stems from insufficient policy enforcement in DevTools, allowing a remote attacker to potentially trigger heap corruption through a specially crafted HTML page. The attack requires user interaction (UI:R) but is low complexity (AC:L) and can lead to high integrity impact (I:H). While not listed in CISA KEV or having public exploit code, it has garnered some community discussion and media coverage, including a mention in a Microsoft Patch Tuesday article, though it is not currently considered actively exploited.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 105.0.5195.52CPE match | cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* | ||
37CPE matchmatch criteria | cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.