CVE-2022-1096
published 2022-07-23CVE-2022-1096: Type confusion in V8 in Google Chrome prior to 99.0.4844.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
PriorityP186high8.8CVSS 3.1
AVNACLPRNUIRSUCHIHAH
KEVITW
CISA Known Exploited Vulnerabilitydue 2022-04-18
Exploited in the wild
EPSS
24.24%
97.6th percentile
Type confusion in V8 in Google Chrome prior to 99.0.4844.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| chromium | chromium | >= 0 < 99.0.4844.84-1~deb11u1 | 99.0.4844.84-1~deb11u1 |
| chromium | chromium | >= 0 < 99.0.4844.84-1 | 99.0.4844.84-1 |
| chromium | chromium | >= 0 < 99.0.4844.84-1 | 99.0.4844.84-1 |
| chromium | chromium | >= 0 < 99.0.4844.84-1 | 99.0.4844.84-1 |
| debian | chromium | < chromium 99.0.4844.84-1 (bookworm) | chromium 99.0.4844.84-1 (bookworm) |
| chrome | < 99.0.4844.84 | 99.0.4844.84 | |
| chrome | >= unspecified < 99.0.4844.84 | 99.0.4844.84 | |
| chrome_chrome | — | — | |
| msrc | microsoft_edge | — | — |
| msrc | microsoft_visual_studio_2022_version_17.0 | — | — |
| msrc | microsoft_visual_studio_2022_version_17.1 | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →CVE-2022-1096 is a type confusion vulnerability in Chrome's V8 JavaScript engine, confirmed exploited in the wild as a zero-day. Detection should focus on identifying unpatched Chrome/Chromium-based browsers (versions prior to 99.0.4844.84) in the environment. ↗
- →The vulnerability could allow a threat actor to perform out-of-bounds memory access via the V8 engine; monitor for anomalous renderer process crashes or memory corruption signals in Chrome/Chromium-based applications. ↗
- →Rockwell Automation ICS products embedding Chromium (FactoryTalk Linx Enterprise 6.20/6.21/6.30, eHIM for PowerFlex 6000T v1.001, Connected Components Workbench v11/12/13/20, FactoryTalk View Site Edition v13) are affected; audit OT environments for these specific product versions. ↗
- →For Rockwell FactoryTalk View Site Edition, the vulnerable WebView2 runtime is located at a known path; check for outdated Microsoft WebView2 FixedVersionRuntime installations at this directory. ↗
- →For Chromium-based Microsoft Edge used with eHIM for PowerFlex 6000T, flag Edge versions below 99.0.1150 as vulnerable. ↗
- ·No public proof-of-concept exploit was available at time of reporting, though in-the-wild exploitation was confirmed. Exploitation details and full technical write-up had not been published by NVD at time of blog publication. ↗
- ·In the context of Rockwell Automation ICS products, the vulnerability is NOT remotely exploitable and results only in a denial-of-service (temporary unavailability), not arbitrary code execution — the CVSS score was adjusted accordingly to 4.0. ↗
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
osv8.8HIGH
vulncheck8.8HIGH
cisa8.8HIGH
vendor_debian8.8HIGH
vendor_msrc8.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
Rockwell Products Impacted by Chromium Type Confusion
cisa_ics·2022-07-28·CVSS 8.8
[HIGH] Rockwell Products Impacted by Chromium Type Confusion
## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs.
ICS Advisory
##
Rockwell Products Impacted by Chromium Type Confusion
Last RevisedJuly 28, 2022
Alert CodeICSA-22-209-01
## 1. EXECUTIVE SUMMARY
- CVSS v3 4.0
- ATTENTION: Low attack complexity/public exploits are available
- Vendor: Rockwell Automation
- Equipment: FactoryTalk Software, Enhanced HIM for PowerFlex, Connected Components Workbench
- Vulnerability: Type Confusion
## 2. RISK EVALUATION
Successful exploitation of this vulnerability could cause a denial-of-service condition.
## 3. TECHNICAL DETAILS
## 3.1 AFFECTED PRODUCTS
The following versions of Rockwell products are affe
Chrome
Long Term Support Channel Update: CVE-2022-1096
vendor_chrome·2022-04-15·CVSS 8.8
CVE-2022-1096 [HIGH] Long Term Support Channel Update: CVE-2022-1096
Long Term Support Channel Update
CVE-2022-1096: Type Confusion in V8. 1311641 High CVE-2022-1232: Type Confusion in V8
Severity: high
Ubuntu
Chromium vulnerability
vendor_ubuntu·2022-03-28
CVE-2022-1096 Chromium vulnerability
Title: Chromium vulnerability
Summary: Chromium could be made to execute arbitrary code if it received a specially
crafted input.
It was discovered that Chromium incorrectly handled certain inputs.
An attacker could possibly use this issue to execute arbitrary code.
Instructions: This update uses a new upstream release, which includes additional bug
fixes. In general, a standard system update will make all the necessary
changes.
CISA
Google Chromium V8 Type Confusion Vulnerability
cisa·2022-03-28·CVSS 8.8
CVE-2022-1096 [HIGH] CWE-843 Google Chromium V8 Type Confusion Vulnerability
Vulnerability: Google Chromium V8 Type Confusion Vulnerability
Affected: Google Chromium V8
Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Required Action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2022-1096
Remediation Due Date: 2022-04-18
Microsoft
Chromium: CVE-2022-1096 Type Confusion in V8
vendor_msrc·2022-03-08·CVSS 8.8
CVE-2022-1096 [HIGH] Chromium: CVE-2022-1096 Type Confusion in V8
Chromium: CVE-2022-1096 Type Confusion in V8
Description: This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.
Google is aware that an exploit for CVE-2022-1096 exists in the wild.
FAQ: Why were Visual Studio 2022 version 17.0 and Visual Studio 2022 version 17.1 added to this Chrome CVE for Microsoft Edge?
These versions of Visual Studio 2022 use webview2 to render certain content, and this CVE addresses a vulnerability in that component.
FAQ: What is the version information for this release?
Microsoft Edge Version
Date Released
Based on Chromium Version
99.0.1150.55
3/26/2022
99.0.4844.84
FAQ: Why is this Chrome CVE included in the Security Update Guide?
The v
Debian
CVE-2022-1096: chromium - Type confusion in V8 in Google Chrome prior to 99.0.4844.84 allowed a remote att...
vendor_debian·2022·CVSS 8.8
CVE-2022-1096 [HIGH] CVE-2022-1096: chromium - Type confusion in V8 in Google Chrome prior to 99.0.4844.84 allowed a remote att...
Type confusion in V8 in Google Chrome prior to 99.0.4844.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Scope: local
bookworm: resolved (fixed in 99.0.4844.84-1)
bullseye: resolved (fixed in 99.0.4844.84-1~deb11u1)
forky: resolved (fixed in 99.0.4844.84-1)
sid: resolved (fixed in 99.0.4844.84-1)
trixie: resolved (fixed in 99.0.4844.84-1)
OSV
CVE-2022-1096: Type confusion in V8 in Google Chrome prior to 99
osv·2022-07-23·CVSS 8.8
CVE-2022-1096 [HIGH] CVE-2022-1096: Type confusion in V8 in Google Chrome prior to 99
Type confusion in V8 in Google Chrome prior to 99.0.4844.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Project0
2022 0-day In-the-Wild Exploitation…so far - Project Zero
project_zero·2022-06-01·CVSS 8.8
CVE-2016-5128 [HIGH] 2022 0-day In-the-Wild Exploitation…so far - Project Zero
Posted by Maddie Stone, Google Project Zero
This blog post is an overview of a talk, “ 0-day In-the-Wild Exploitation in 2022…so far”, that I gave at the FIRST conference in June 2022. The slides are available here.
For the last three years, we’ve published annual year-in-review reports of 0-days found exploited in the wild. The most recent of these reports is the 2021 Year in Review report, which we published just a few months ago in April. While we plan to stick with that annual cadence, we’re publishing a little bonus report today looking at the in-the-wild 0-days detected and disclosed in the first half of 2022.
As of June 15, 2022, there have been 18 0-days detected and disclosed as exploited in-the-wild in 2022. When we analyzed those 0-days, we found that at least nin
VulnCheck
Google Chromium V8 Type Confusion Vulnerability
vulncheck·2022·CVSS 8.8
CVE-2022-1096 [HIGH] CWE-843 Google Chromium V8 Type Confusion Vulnerability
Google Chromium V8 Type Confusion Vulnerability
Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Affected: Google Chromium V8
Required Action: Apply updates per vendor instructions.
Exploitation References: https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit; https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; https://securelist.com/it-threat-evolution-in-q2-2022-non-mobile-statistics/107133/; https://raw.githubusercontent.com/blackorbird/APT_REPORT/master/summ
Project0
Project Zero RCA: CVE-2022-1096: Chrome Type Confusion in Property Access Interceptor
project_zero·CVSS 8.8
CVE-2022-1096 [HIGH] Project Zero RCA: CVE-2022-1096: Chrome Type Confusion in Property Access Interceptor
# CVE-2022-1096: Chrome Type Confusion in Property Access Interceptor
## The Basics
**Disclosure or Patch Date:** 25 March 2022
**Product:** Google Chromium
**Advisory:** https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop_25.html
**Affected Versions:** pre 99.0.4844.84
**First Patched Version:** 99.0.4844.84
**Issue/Bug Report:** https://bugs.chromium.org/p/chromium/issues/detail?id=1309225
**Patch CL:** https://chromium.googlesource.com/v8/v8/+/0981e91a4f8692af337e2588562ad1504f4bffdc
**Bug-Introducing CL:** N/A
**Reporter(s):** Anonymous
## The Code
**Proof-of-concept:**
```
style = document.createElement('p').style;
style.prop = { toString: () => {
style.prop = 1;
}};
```
**Exploit sample:** N/A
**Access to the exploit sample?** No
## The Vu
No detection rules found.
No public exploits indexed.
Tenable
Mind the Gap: A Closer Look at Eight Notable CVEs from 2022
blogs_tenable·2023-05-09
Mind the Gap: A Closer Look at Eight Notable CVEs from 2022
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Qualys
The 9th Google Chrome Zero-Day Threat this Year – Again Just Before the Weekend
blogs_qualys·2022-12-03·CVSS 8.8
CVE-2022-4262 [HIGH] The 9th Google Chrome Zero-Day Threat this Year – Again Just Before the Weekend
## Table of Contents
Organizations respond, but slowly
Qualys Patch Management speeds remediation
Google has released yet another security update for the Chrome desktop web browser to address a high-severity vulnerability that is being exploited in the wild. This is the ninth Chrome zero-day fixed this year by Google. This security bug ( CVE-2022-4262 ; QID 377804 ) is a Type Confusion vulnerability in Chrome’s V8 JavaScript Engine.
Google has withheld details about the vulnerability to prevent expanding its malicious exploitation and to allow users time to apply the security updates necessary on their Chrome installations.
Google’s previous zero-days were also released right before a weekend (see Don’t spend another weekend patching Chrome and Don’t Spend Your Holiday Season Patching
Securelist
Non-mobile malware statistics, Q2 2022
blogs_securelist·2022-08-15
Non-mobile malware statistics, Q2 2022
Table of Contents
- Quarterly figures
- Financial threats
- Ransomware programs
- Miners
- Vulnerable applications used by criminals during cyberattacks
- Attacks on macOS
- IoT attacks
- Attacks via web resources
- Local threats
Authors
- AMR
- IT threat evolution in Q2 2022
- IT threat evolution in Q2 2022. Non-mobile statistics
- IT threat evolution in Q2 2022. Mobile statistics
These statistics are based on detection verdicts of Kaspersky products and services received from users who consented to providing statistical data.
## Quarterly figures
According to Kaspersky Security Network, in Q2 2022:
- Kaspersky solutions blocked 1,164,544,060 attacks from online resources across the globe.
- Web Anti-Virus recognized 273,033,368 unique URLs as malicious. Attempts to run malware fo
Tenable
Cybersecurity Snapshot: 6 Things That Matter Right Now
blogs_tenable·2022-06-17
Cybersecurity Snapshot: 6 Things That Matter Right Now
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Tenable
So Many CVEs, So Little Time: Zero In and ‘Zero Click’ into the Current Vulnerability Landscape
blogs_tenable·2022-06-08
So Many CVEs, So Little Time: Zero In and ‘Zero Click’ into the Current Vulnerability Landscape
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Securelist
IT threat evolution in Q1 2022. Non-mobile statistics
blogs_securelist·2022-05-27
IT threat evolution in Q1 2022. Non-mobile statistics
Table of Contents
Quarterly figures
Financial threats
Financial threat statistics
Geography of financial malware attacks
TOP 10 banking malware families
Ransomware programs
Quarterly trends and highlights
Law enforcement successes
HermeticWiper, HermeticRansom and RUransom, etc.
Conti source-code leak
Attacks on NAS devices
Maze Decryptor
Number of new modifications
Number of users attacked by ransomware Trojans
Geography of attacked users
TOP 10 most common families of ransomware Trojans
Miners
Number of new miner modifications
Number of users attacked by miners
Geography of miner attacks
Vulnerable applications used by criminals during cyberattacks
Quarter highlights
Vulnerability statistics
Attacks on macOS
Geography of threats for macOS
IoT attacks
IoT threat
Securelist
PC malware statistics, Q1 2022
blogs_securelist·2022-05-27
PC malware statistics, Q1 2022
Table of Contents
- Quarterly figures
- Financial threats
- Ransomware programs
- Miners
- Vulnerable applications used by criminals during cyberattacks
- Attacks on macOS
- IoT attacks
- Attacks via web resources
- Local threats
Authors
- AMR
- IT threat evolution in Q1 2022
- IT threat evolution in Q1 2022. Non-mobile statistics
- IT threat evolution in Q1 2022. Mobile statistics
These statistics are based on detection verdicts of Kaspersky products and services received from users who consented to providing statistical data.
## Quarterly figures
According to Kaspersky Security Network, in Q1 2022:
- Kaspersky solutions blocked 1,216,350,437 attacks from online resources across the globe.
- Web Anti-Virus recognized 313,164,030 unique URLs as malicious.
- Attempts to run malware
Checkpoint
28th March – Threat Intelligence Report
blogs_checkpoint·2022-03-28
CVE-2022-24934 28th March – Threat Intelligence Report
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 28th March – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 28th March, please download our Threat Intelligence Bulletin .
Top Attacks and Breaches
Large companies including Microsoft, Okta, NVIDIA, Samsung & Ubisoft have been breached by the Lapsus$ hacking group. This cyber gang is best known for publishing sensitive information stolen from major technology companies and governments. How the gang managed to breach these targets is not yet clear to the public. In recent
https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop_25.htmlhttps://crbug.com/1309225https://security.gentoo.org/glsa/202208-25https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop_25.htmlhttps://crbug.com/1309225https://security.gentoo.org/glsa/202208-25https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-1096
2022-07-23
Published
2022-03-28
Added to CISA KEV
Exploited in the wild