Malwarecritical
Spyware campaigns using zero-days found in Italy, Malaysia, Kazakhstan, UAE
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2021-30900 | Kernel Out-of-Bounds Write in Apple iOS, iPadOS, and macOS (Actively Exploited) | 7.8 | 5% | KEV | KEV |
| CVE-2022-22706 | Unprivileged Memory-Write Flaw in Arm Mali GPU Kernel Drivers | 7.8 | 1% | KEV | KEV |
| CVE-2022-3038 | Use-After-Free in Chromium Network Service Affects Chrome, Edge, Opera | 8.8 | 25% | KEVPoC | KEV |
| CVE-2022-3723 | Actively Exploited V8 Type Confusion in Google Chrome (CVE-2022-3723) | 8.8 | 8% | KEV | KEV |
| CVE-2022-38181 | Use-After-Free Vulnerability in Arm Mali GPU Kernel Driver (Bifrost/Valhall/Midgard) | 8.8 | 18% | KEVPoC ×2 | KEV |
| CVE-2022-4135 | Chromium GPU heap buffer overflow enables sandbox escape (affects Chrome, Edge, Opera) | 9.6 | 32% | KEVPoC | KEV |
| CVE-2022-4262 | Type Confusion in Google Chrome V8 JavaScript Engine Exploited in the Wild (CVE-2022-4262) | 8.8 | 24% | KEV | KEV |
| CVE-2022-42856 | Type Confusion in Apple WebKit (Safari/iOS/macOS/tvOS), Actively Exploited | 8.8 | 9% | KEV | KEV |
| CVE-2023-0266 | Use-After-Free in Linux Kernel ALSA PCM Enables Local Privilege Escalation | 7.0 | 4% | KEV | KEV |
From the original article
5 min read at therecord.media
Two targeted spyware campaigns involving several zero-day exploits for Android, iOS and mobile versions of the Chrome browser were unmasked by researchers from Google on Wednesday. One campaign targeted people in Italy, Malaysia and Kazakhstan, while the other operated in the United Arab Emirates (UAE), the researchers said. Google called the campaigns “distinct, limited and highly targeted.”
therecord.media
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.