CVE-2022-2295
published 2022-07-28CVE-2022-2295: Type confusion in V8 in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
PriorityP183high8.8CVSS 3.1
AVNACLPRNUIRSUCHIHAH
ITWVulnCheck KEVRansomware
Exploited in the wild
EPSS
1.23%
65.2th percentile
Type confusion in V8 in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| chromium | chromium | >= 0 < 103.0.5060.114-1~deb11u1 | 103.0.5060.114-1~deb11u1 |
| chromium | chromium | >= 0 < 103.0.5060.114-1 | 103.0.5060.114-1 |
| chromium | chromium | >= 0 < 103.0.5060.114-1 | 103.0.5060.114-1 |
| chromium | chromium | >= 0 < 103.0.5060.114-1 | 103.0.5060.114-1 |
| debian | chromium | < chromium 103.0.5060.114-1 (bookworm) | chromium 103.0.5060.114-1 (bookworm) |
| fedoraproject | extra_packages_for_enterprise_linux | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| chrome | < 103.0.5060.114 | 103.0.5060.114 | |
| chrome | >= unspecified < 103.0.5060.114 | 103.0.5060.114 | |
| msrc | microsoft_edge | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →CVE-2022-2295 is a Type Confusion vulnerability in V8 (Chrome/Chromium); exploitation requires delivery of a crafted HTML page to the victim — monitor for suspicious or anomalous HTML/JS content triggering V8 type confusion conditions in Chrome prior to 103.0.5060.114 ↗
- →CVE-2022-2295 was patched in Chrome 103.0.5060.114 — flag any Chrome/Chromium-based browser (including Microsoft Edge Chromium) running a version older than 103.0.5060.114 as unpatched and at risk ↗
- ·CVE-2022-2295 affects Google Chrome prior to 103.0.5060.114 and Microsoft Edge (Chromium-based) versions that ingest the vulnerable Chromium build; the fix is confirmed in Chrome 103.0.5060.114 and the corresponding Edge release ↗
- ·Debian packages for bookworm, bullseye, forky, sid, and trixie are all resolved at 103.0.5060.114-1 (or ~deb11u1 for bullseye); systems running older Debian Chromium packages remain vulnerable ↗
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
osv8.8HIGH
vulncheck8.8HIGH
vendor_debian8.8HIGH
vendor_msrc8.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Microsoft
Chromium: CVE-2022-2295 Type Confusion in V8
vendor_msrc·2022-07-12·CVSS 8.8
CVE-2022-2295 [HIGH] Chromium: CVE-2022-2295 Type Confusion in V8
Chromium: CVE-2022-2295 Type Confusion in V8
Description: This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.
FAQ: Why is this Chrome CVE included in the Security Update Guide?
The vulnerability assigned to this CVE is in Chromium Open Source Software (OSS) which is consumed by Microsoft Edge (Chromium-based). It is being documented in the Security Update Guide to announce that the latest version of Microsoft Edge (Chromium-based) is no longer vulnerable.
How can I see the version of the browser?
In your Microsoft Edge browser, click on the 3 dots (...) on the very right-hand side of the window
Click on Help and Feedback
Click on About Microsoft Edge
Microsoft Edg
Debian
CVE-2022-2295: chromium - Type confusion in V8 in Google Chrome prior to 103.0.5060.114 allowed a remote a...
vendor_debian·2022·CVSS 8.8
CVE-2022-2295 [HIGH] CVE-2022-2295: chromium - Type confusion in V8 in Google Chrome prior to 103.0.5060.114 allowed a remote a...
Type confusion in V8 in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Scope: local
bookworm: resolved (fixed in 103.0.5060.114-1)
bullseye: resolved (fixed in 103.0.5060.114-1~deb11u1)
forky: resolved (fixed in 103.0.5060.114-1)
sid: resolved (fixed in 103.0.5060.114-1)
trixie: resolved (fixed in 103.0.5060.114-1)
GHSA
GHSA-gmjf-5wf6-pxg7: Type confusion in V8 in Google Chrome prior to 103
ghsa_unreviewed·2022-07-29
CVE-2022-2295 [HIGH] CWE-843 GHSA-gmjf-5wf6-pxg7: Type confusion in V8 in Google Chrome prior to 103
Type confusion in V8 in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
OSV
CVE-2022-2295: Type confusion in V8 in Google Chrome prior to 103
osv·2022-07-28·CVSS 8.8
CVE-2022-2295 [HIGH] CVE-2022-2295: Type confusion in V8 in Google Chrome prior to 103
Type confusion in V8 in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
VulnCheck
Google Chrome Access of Resource Using Incompatible Type ('Type Confusion')
vulncheck·2022·CVSS 8.8
CVE-2022-2295 [HIGH] Google Chrome Access of Resource Using Incompatible Type ('Type Confusion')
Google Chrome Access of Resource Using Incompatible Type ('Type Confusion')
Type confusion in V8 in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Affected: Google Chrome
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Known Ransomware Campaign Use: Known
Exploitation References: https://socradar.io/dark-web-profile-medusa-ransomware-medusalocker/; https://www.loginsoft.com/reports/annually/vulnerability-intelligence-report-2025
No detection rules found.
No public exploits indexed.
Securelist
IT threat evolution in Q3 2022. Non-mobile statistics
blogs_securelist·2022-11-18
IT threat evolution in Q3 2022. Non-mobile statistics
Table of Contents
Quarterly figures
Financial threats
Number of users attacked by banking malware
TOP 10 banking malware families
Geography of financial malware attacks
Ransomware programs
Quarterly trends and highlights
Number of new modifications
Number of users attacked by ransomware Trojans
Geography of attacked users
TOP 10 most common families of ransomware Trojans
Miners
Number of new miner modifications
Number of users attacked by miners
Geography of miner attacks
Vulnerable applications used by criminals during cyberattacks
Quarterly highlights
Vulnerability statistics
Attacks on macOS
TOP 20 threats for macOS
Geography of threats for macOS
IoT attacks
IoT threat statistics
Attacks via web resources
Countries and territories that serve as sources of web-ba
Securelist
PC malware statistics, Q3 2022
blogs_securelist·2022-11-18
PC malware statistics, Q3 2022
Table of Contents
- Quarterly figures
- Financial threats
- Ransomware programs
- Miners
- Vulnerable applications used by criminals during cyberattacks
- Attacks on macOS
- IoT attacks
- Attacks via web resources
- Local threats
Authors
- AMR
- IT threat evolution in Q3 2022
- IT threat evolution in Q3 2022. Non-mobile statistics
- IT threat evolution in Q3 2022. Mobile statistics
These statistics are based on detection verdicts of Kaspersky products and services received from users who consented to providing statistical data.
## Quarterly figures
According to Kaspersky Security Network, in Q3 2022:
- Kaspersky solutions blocked 956,074,958 attacks from online resources across the globe.
- Web Anti-Virus recognized 251,288,987 unique URLs as malicious.
- Attempts to run malware fo
Qualys
July 2022 Patch Tuesday | Microsoft Releases 84 Vulnerabilities with 4 Critical, plus 2 Microsoft Edge (Chromium-Based) | Qualys
blogs_qualys·2022-07-12·CVSS 7.8
[HIGH] July 2022 Patch Tuesday | Microsoft Releases 84 Vulnerabilities with 4 Critical, plus 2 Microsoft Edge (Chromium-Based) | Qualys
#### Table of Contents
- Microsoft Patch Tuesday Summary
- The July 2022 Microsoft Vulnerabilities Are Classified As Follows:
- Notable Microsoft Vulnerabilities Patched
- Microsoft Critical Vulnerability Highlights
- Microsoft Last But Not Least
- Adobe Security Bulletins and Advisories
- Discover and Prioritize Vulnerabilities in Vulnerability Management Detection Response (VMDR)
- Rapid Response With Patch Management (PM)
- Qualys Monthly Webinar Series
- Join the Webinar This Month in Vulnerabilities & Patches
## Microsoft Patch Tuesday Summary
Microsoft has fixed 84 vulnerabilities (aka flaws) in the July 2022 update, including four vulnerabilities classified as critical as they allow Remote Code Execution (RCE). This month’s Patch Tuesday cumulative Windows update includes the fix
Qualys
July 2022 Patch Tuesday | Microsoft Releases 84 Vulnerabilities With 4 Critical, Plus 2 Microsoft Edge (Chromium-Based); Adobe Releases 4 Advisories, 27 Vulnerabilities With 18 Critical.
blogs_qualys·2022-07-12·CVSS 7.8
[HIGH] July 2022 Patch Tuesday | Microsoft Releases 84 Vulnerabilities With 4 Critical, Plus 2 Microsoft Edge (Chromium-Based); Adobe Releases 4 Advisories, 27 Vulnerabilities With 18 Critical.
## Table of Contents
Microsoft Patch Tuesday Summary
The July 2022 Microsoft Vulnerabilities Are Classified As Follows:
Notable Microsoft Vulnerabilities Patched
Microsoft Critical Vulnerability Highlights
Microsoft Last But Not Least
Adobe Security Bulletins and Advisories
Discover and Prioritize Vulnerabilities in Vulnerability Management Detection Response (VMDR)
Rapid Response With Patch Management (PM)
Qualys Monthly Webinar Series
Join the Webinar This Month in Vulnerabilities & Patches
## Microsoft Patch Tuesday Summary
Microsoft has fixed 84 vulnerabilities (aka flaws) in the July 2022 update, including four vulnerabilities classified as critical as they allow Remote Code Execution (RCE). This month’s Patch Tuesday cumulative Windows update includes the fix for one acti
Talos
Threat Source newsletter (July 7, 2022) — Teamwork makes the dream work
blogs_talos·2022-07-07
Threat Source newsletter (July 7, 2022) — Teamwork makes the dream work
Welcome to this week’s edition of the Threat Source newsletter.
I’ve been thinking a lot recently about the pros and cons of the way we publicize our threat research. I had a few conversations at Cisco Live with people — who are more generally IT-focused than hyper-focused on cybersecurity — about the amount of information we share on our blog and social media profiles. Our blog serves as the main mouthpiece for Talos, but I’m also always talking to our audience, directly or indirectly, through social media channels, our podcasts, or out in the world at conferences. But during these conversations, readers may wonder if we’re indirectly “helping” the bad guys by pointing out what they’re doing wrong or what we are doing to track them.
There will always be pros and cons to any type of disc
Talos
Threat Source newsletter (July 7, 2022) — Teamwork makes the dream work
blogs_talos·2022-07-07
Threat Source newsletter (July 7, 2022) — Teamwork makes the dream work
## Threat Source newsletter (July 7, 2022) — Teamwork makes the dream work
Welcome to this week’s edition of the Threat Source newsletter.
I’ve been thinking a lot recently about the pros and cons of the way we publicize our threat research. I had a few conversations at Cisco Live with people — who are more generally IT-focused than hyper-focused on cybersecurity — about the amount of information we share on our blog and social media profiles. Our blog serves as the main mouthpiece for Talos, but I’m also always talking to our audience, directly or indirectly, through social media channels, our podcasts, or out in the world at conferences. But during these conversations, readers may wonder if we’re indirectly “helping” the bad guys by pointing out what they’re doing wrong or what we are
https://chromereleases.googleblog.com/2022/07/stable-channel-update-for-desktop.htmlhttps://crbug.com/1336869https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5BQRTR4SIUNIHLLPWTGYSDNQK7DYCRSB/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H2C4XOJVIILDXTOSMWJXHSQNEXFWSOD7/https://security.gentoo.org/glsa/202208-35https://chromereleases.googleblog.com/2022/07/stable-channel-update-for-desktop.htmlhttps://crbug.com/1336869https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5BQRTR4SIUNIHLLPWTGYSDNQK7DYCRSB/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H2C4XOJVIILDXTOSMWJXHSQNEXFWSOD7/https://security.gentoo.org/glsa/202208-35
2022-07-28
Published
Exploited in the wild