CISA adds Google Chromium V8 Type Confusion bug to its Known Exploited Vulnerabilities catalog

Apple's WebKit engine, which renders web content for Safari and for essentially all HTML processing on iOS, iPadOS, and macOS, contains a flaw that leads to code execution when processing maliciously crafted web content. It is triggered when a user's browser or embedded web view loads attacker-controlled web content, so simply visiting a hostile page can be enough. Successful exploitation could allow arbitrary code execution within the affected application's context, a common stepping stone to broader device compromise. All users of Apple iOS, iPadOS, macOS, and Safari are potentially affected, as are users of non-Apple products that rely on WebKit for HTML processing. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2023-09-25, indicating confirmed in-the-wild exploitation; no public proof-of-concept is known.

Do: Apply Apple's latest security updates for iOS, iPadOS, macOS, and Safari that patch WebKit, following the vendor instructions referenced by the CISA KEV entry, and treat unpatched WebKit builds as actively exploited. Until systems are patched, restrict exposure to untrusted web content (e.g., limit browsing and in-app web views to trusted sites for high-risk users). Also inventory any non-Apple applications or HTML-processing components in your environment that bundle WebKit and update them as their maintainers ship fixes.

CVE-2023-4762 is a type confusion bug (CWE-843) in the V8 JavaScript engine used by Google Chromium, allowing a remote attacker to execute arbitrary code in the context of the browser when a user visits or is redirected to a crafted HTML page. Because V8 is shared across Chromium-based browsers, the flaw affects Google Chrome, Microsoft Edge, Opera, and other Chromium derivatives, not just Chrome itself. Successful exploitation gives an attacker code execution within the browser process on the victim's machine, a common foothold for delivering further malware. Google patched the bug in Chrome 116.0.5845.179/.180 (September 2023); any Chromium-based browser built on unpatched V8 remains vulnerable, and no public proof-of-concept is known. CISA added CVE-2023-4762 to the Known Exploited Vulnerabilities catalog on 2024-02-06, confirming exploitation in the wild (ransomware use unconfirmed), and EPSS assigns a ~41% probability of exploitation within 30 days (99th percentile).

Do: Patch all Chromium-based browsers fleet-wide to Chrome 116.0.5845.179/.180 or later and each vendor's equivalent (current Edge, Opera, Brave, etc.), consistent with the CISA KEV required action to apply vendor mitigations or discontinue use. Verify Chromium/V8 browser versions in your endpoint inventory before and after rollout; since exploitation is triggered by a crafted web page, interim mitigations include restricting unpatched machines' browsing and warning users about unsolicited links.