Google Releases Urgent Chrome Update to Fix Actively Exploited Zero

Google Chromium's V8 JavaScript engine contains a type confusion flaw (CWE-843) that a remote attacker can trigger by getting a user to open a crafted HTML page, causing heap corruption and potentially enabling code execution in the browser renderer. Because V8 underpins all Chromium-based browsers, Google Chrome, Microsoft Edge, Opera, and any other Chromium-derived browser built before the late-March 2022 fixes are affected. A successful exploit yields heap corruption in the renderer, which attackers typically use to run code in the browser process and often chain with sandbox escapes for broader system compromise. The vulnerability is confirmed exploited in the wild — CISA added it to the Known Exploited Vulnerabilities catalog on 2022-03-28 with a required action of applying vendor updates — and EPSS assigns a 24.4% probability of exploitation within 30 days (98th percentile), though no public proof-of-concept is known. CVSS scoring was not yet available at the time of this data.

Do: Update Chromium-based browsers immediately — Google Chrome to 99.0.4844.84 or later, Microsoft Edge to 99.0.1150.55 or later, and Opera to its equivalent Chromium 99 build — and verify versions via chrome://version or edge://version. There is no server-side mitigation because exploitation occurs when a user loads attacker-crafted HTML, so prioritize endpoint browser patching and rebuild any applications that embed Chromium (e.g., Electron apps) on patched V8.

CVE-2022-1364 is a type confusion flaw (CWE-843) in the Turbofan JIT compiler of the V8 JavaScript engine, as shipped in Google Chrome. A remote attacker can trigger it by persuading a user to open a crafted HTML page, and successful exploitation can lead to heap corruption in the browser renderer. Per the CVSS vector, no privileges are required but user interaction is needed, with high potential impact on confidentiality, integrity, and availability. Anyone running Google Chrome prior to 100.0.4896.127 — and, per CISA's designation, the affected Google Chromium V8 component — is exposed until patched. The bug was exploited as a zero-day in the wild (reported as the ninth actively exploited Chrome zero-day of 2022), was added to CISA's KEV catalog on 2022-04-15, and carries a 13.7% probability of exploitation in the next 30 days (96th EPSS percentile).

Do: Update Google Chrome immediately to 100.0.4896.127 or later on all platforms, as required by the vendor and by CISA's KEV required action. Organizations using Chromium-based browsers (Edge, Brave, Opera, Vivaldi, etc.) should verify their vendors have shipped the corresponding V8 fix rather than waiting on version numbers. Given exploitation via crafted web pages, scan endpoint inventories for Chrome versions below 100.0.4896.127 and prioritize user-facing fleets.

CVE-2022-3723 is a type confusion vulnerability (CWE-843) in the V8 JavaScript engine used by Google Chrome, rated High severity with a CVSS 3.1 score of 8.8. It is triggered remotely when a user renders a crafted HTML page, allowing a remote attacker to potentially exploit heap corruption in the browser; the high confidentiality, integrity, and availability impact reflects likely code execution. All Google Chrome releases prior to 107.0.5304.87 are affected, and per CISA the underlying flaw resides in Google Chromium V8, so Chromium-based browsers embedding the same engine are similarly exposed pending their own updates. The flaw was exploited as a zero-day: CISA added it to the Known Exploited Vulnerabilities catalog on 2022-10-28, and news coverage describes it as Google's ninth actively exploited Chrome zero-day of 2022, amid reports of spyware vendors exploiting zero-days in the wild. EPSS assigns a 7.9% probability (94th percentile) of exploitation activity in the next 30 days.

Do: Update Google Chrome to 107.0.5304.87 or later on all endpoints and restart the browser to complete the patch, verifying the installed version via chrome://version; apply the corresponding V8/Chromium update in any Chromium-based browsers your organization ships. CISA's KEV required action is to apply updates per vendor instructions, so prioritize managed fleets, user workstations, and any browsers exposed to untrusted web content. No public PoC or workaround is known, so patching is the sole effective mitigation.

CVE-2022-4262 is a type confusion vulnerability in the V8 JavaScript engine used by Google Chrome, in which incorrect handling of object types can lead to heap corruption. An attacker can trigger the flaw by convincing a user to visit a specially crafted HTML page, with no privileges or special network access required. Successful exploitation could allow remote code execution or information disclosure within the browser process, and the High severity rating and web-reachable attack vector reflect significant potential impact. All Google Chrome users running versions prior to 108.0.5359.94 are affected, as are users of Chromium-based browsers incorporating the vulnerable V8 code. The vulnerability was a zero-day exploited in the wild prior to the patch — attributed by media reports to commercial spyware vendors targeting Android and iOS devices — and CISA added it to the Known Exploited Vulnerabilities catalog on 2022-12-05.

Do: Update Google Chrome to 108.0.5359.94 or later on all endpoints, and apply equivalent updates from vendors of Chromium-based browsers (e.g., Microsoft Edge, Brave, Opera) as they ship patched V8 builds. Verify the fixed version is running via chrome://settings/help or your patch-management inventory, and treat browser exploit chains as a spyware risk: review endpoint telemetry for signs of compromise, especially on mobile or high-target devices. CISA's required action is to apply updates per vendor instructions.

CVE-2023-2033 is a type confusion flaw (CWE-843) in Google's Chromium V8 JavaScript engine that a remote attacker can trigger by convincing a user to load a crafted HTML page. Successful exploitation could lead to heap corruption in the browser, potentially allowing the attacker to execute code in the context of the affected browser. Because V8 underpins the entire Chromium ecosystem, users of Google Chrome, Microsoft Edge, Opera, and any other Chromium-based browser or application are potentially affected. The flaw is already being exploited: CISA added it to the Known Exploited Vulnerabilities catalog on 2023-04-17, and EPSS assigns a 40.8% probability of exploitation within 30 days (99th percentile), though no public proof-of-concept is known and ransomware use is unknown.

Do: Update Google Chrome and every other Chromium-based browser in use (Microsoft Edge, Opera, Brave, etc.) to the latest vendor-supplied stable release, per CISA's KEV required action to apply updates per vendor instructions. Verify installed browser versions across managed endpoints and treat unpatched Chromium builds as actively exploited given the KEV listing and high EPSS score.

CVE-2023-28205 is a use-after-free flaw (CWE-416) in the WebKit engine shipped with Apple iOS, iPadOS, macOS, and the Safari browser, where memory is freed and then incorrectly reused while processing HTML. It is triggered when a device processes maliciously crafted web content, meaning simply loading an attacker-controlled page in Safari or any WebKit-based HTML renderer can trigger the bug. Successful exploitation allows the attacker to achieve code execution in the context of the WebKit process on the victim device. All users of iOS, iPadOS, macOS, and Safari are potentially affected, as are non-Apple products that rely on WebKit for HTML processing. The flaw is being actively exploited in the wild — it was added to CISA's Known Exploited Vulnerabilities catalog on 2023-04-10, with the required action to apply updates per vendor instructions — and EPSS assigns a 27.1% probability of exploitation within 30 days (98th percentile).

Do: Apply Apple's current security updates for iOS, iPadOS, macOS, and Safari as soon as possible, per the vendor instructions cited in the CISA KEV listing. Because this is a browser/HTML-engine flaw exploited in the wild, prioritize patching internet-facing and high-risk user fleets; users of non-Apple WebKit-based HTML parsers should check with their software vendors for updated WebKit components. Until patched, exercise caution with untrusted web content.

Apple's IOSurfaceAccelerator component in iOS, iPadOS, and macOS contains an out-of-bounds write flaw (CWE-787). The bug is triggered by an application running locally on the device, which can corrupt memory in the component during a write past a buffer boundary. A successful exploit allows the app to execute arbitrary code with kernel privileges, giving it full control of the device beyond the normal app sandbox. Any user of an Apple iOS, iPadOS, or macOS device running an affected, unpatched version is exposed. The flaw was added to CISA KEV on 2023-04-10, confirming known in-the-wild exploitation; ransomware use is unknown, no public PoC is available, and EPSS assigns a 24.5% probability of exploitation within 30 days (98th percentile).

Do: Update all iPhones, iPads, and Macs to the latest iOS/iPadOS/macOS versions available as of April 2023, per CISA's required action and Apple's security advisories. Use MDM or patch-reporting tooling to inventory endpoints and confirm no devices remain on pre-patch builds. Because exploitation is confirmed in the wild and any local app can act as the trigger, patching is the primary mitigation and there is no dependable configuration workaround.