Malwarecritical
Google TAG shares details about exploit chains used to install commercial spyware
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2021-30900 | Kernel Out-of-Bounds Write in Apple iOS, iPadOS, and macOS (Actively Exploited) | 7.8 | 5% | KEV | KEV |
| CVE-2022-1134 | Type confusion in V8 in Google Chrome prior to 100.0.4896.60 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page | 8.8 | 2% | PoC | |
| CVE-2022-22706 | Unprivileged Memory-Write Flaw in Arm Mali GPU Kernel Drivers | 7.8 | 1% | KEV | KEV |
| CVE-2022-3038 | Use-After-Free in Chromium Network Service Affects Chrome, Edge, Opera | 8.8 | 25% | KEVPoC | KEV |
| CVE-2022-3723 | Actively Exploited V8 Type Confusion in Google Chrome (CVE-2022-3723) | 8.8 | 8% | KEV | KEV |
| CVE-2022-38181 | Use-After-Free Vulnerability in Arm Mali GPU Kernel Driver (Bifrost/Valhall/Midgard) | 8.8 | 18% | KEVPoC ×2 | KEV |
| CVE-2022-4135 | Chromium GPU heap buffer overflow enables sandbox escape (affects Chrome, Edge, Opera) | 9.6 | 32% | KEVPoC | KEV |
| CVE-2022-4262 | Type Confusion in Google Chrome V8 JavaScript Engine Exploited in the Wild (CVE-2022-4262) | 8.8 | 24% | KEV | KEV |
| CVE-2022-42856 | Type Confusion in Apple WebKit (Safari/iOS/macOS/tvOS), Actively Exploited | 8.8 | 9% | KEV | KEV |
| CVE-2023-0266 | Use-After-Free in Linux Kernel ALSA PCM Enables Local Privilege Escalation | 7.0 | 4% | KEV | KEV |
From the original article
3 min read at securityaffairs.com
Google’s Threat Analysis Group (TAG) discovered several exploit chains targeting Android, iOS, and Chrome to install commercial spyware. Google’s Threat Analysis Group (TAG) shared details about two distinct campaigns which used several zero-day exploits against Android, iOS and Chrome. The experts pointed out that both campaigns were limited and highly targeted.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.