CVE-2022-1096KEV · OVERDUE

Google Chromium V8 Type Confusion Vulnerability

High · published July 22, 2022

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 8.8. It is confirmed in active exploitation. It sits in the 97.9th percentile for exploit probability.

1649
days past CISA
deadline
CVSS v3.1
8.8
EPSS
25%
Percentile
97.9
In the wild
Confirmed
What it is

🚨 A cleverly crafted HTML page could lead to heap corruption in Chrome, opening the door for remote attackers to wreak havoc. ⚡ Think of it like a recipe where a sneaky chef swaps ingredients without telling anyone. The dish turns out disastrous, and in this case, the dish is your browser's memory! If exploited, an attacker could gain the ability to manipulate the system, potentially running arbitrary code. This could lead to unauthorized data access, a total system crash, or worse. It's a wild ride that could put all your sensitive information at risk! 🔥

Put simply

Think of it like a recipe where a sneaky chef swaps ingredients without telling anyone. The dish turns out disastrous, and in this case, the dish is your browser's memory! This vulnerability arises from type confusion in the V8 engine, allowing attackers to exploit heap corruption by sending a specially crafted HTML page. This flaw enables the execution of malicious code under the guise of legitimate actions.

What to do

If exploited, an attacker could gain the ability to manipulate the system, potentially running arbitrary code. This could lead to unauthorized data access, a total system crash, or worse. It's a wild ride that could put all your sensitive information at risk! 🔥 Update your Google Chrome browser to version 99.0.4844.84 or later immediately to close this vulnerability. Also, review your browsing habits and consider enabling additional security features such as Safe Browsing. You’ve got this! With these updates, you’ll keep your browser safe and sound. 🛡️

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.24726 · 97.9th percentile
Published
2022-07-22T23:35Z
KEV added
2022-03-28 · due 2022-04-18
EPSS history
Timeline
  • 22 JUL 23:35Z
    Type confusion in V8 in Google Chrome prior to 99.0.4844.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page
    cvelistv5
  • 28 MAR 00:00Z
    Added to CISA KEV — remediate by Apr 18
    kev