CVE-2022-1364

CVE-2022-1364 is a type confusion flaw (CWE-843) in the Turbofan JIT compiler of the V8 JavaScript engine, as shipped in Google Chrome. A remote attacker can trigger it by persuading a user to open a crafted HTML page, and successful exploitation can lead to heap corruption in the browser renderer. Per the CVSS vector, no privileges are required but user interaction is needed, with high potential impact on confidentiality, integrity, and availability. Anyone running Google Chrome prior to 100.0.4896.127 — and, per CISA's designation, the affected Google Chromium V8 component — is exposed until patched. The bug was exploited as a zero-day in the wild (reported as the ninth actively exploited Chrome zero-day of 2022), was added to CISA's KEV catalog on 2022-04-15, and carries a 13.7% probability of exploitation in the next 30 days (96th EPSS percentile).

What to do: Update Google Chrome immediately to 100.0.4896.127 or later on all platforms, as required by the vendor and by CISA's KEV required action. Organizations using Chromium-based browsers (Edge, Brave, Opera, Vivaldi, etc.) should verify their vendors have shipped the corresponding V8 fix rather than waiting on version numbers. Given exploitation via crafted web pages, scan endpoint inventories for Chrome versions below 100.0.4896.127 and prioritize user-facing fleets.