CVE-2022-3723: Google Chrome V8 type confusion enables heap corruption

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityIt is a remotely reachable, high-impact browser flaw with confirmed in-the-wild exploitation per CISA KEV, though it requires user interaction and a patch has long been available.

What it is

CVE-2022-3723 is a type confusion flaw in the V8 JavaScript engine in Google Chrome prior to 107.0.5304.87. A remote attacker can trigger heap corruption by getting a victim to load a crafted HTML page, which can lead to code execution in the browser process. It was added to CISA's Known Exploited Vulnerabilities catalog, so it was exploited in the wild.

Impact

An attacker who successfully exploits the flaw can corrupt heap memory and potentially execute arbitrary code in the context of the browser, gaining the victim's privileges on the host. The CVSS vector rates confidentiality, integrity and availability impact as high.

Attack surface

Reached over the network by serving a crafted HTML page that the victim must open in Chrome; the CVSS vector requires user interaction (UI:R) and no privileges (PR:N). No authentication is needed on the attacker's side.

Exploitation

The record is in CISA KEV (added 2022-10-28, due 2022-11-18), indicating known exploitation in the wild; EPSS 30-day probability is 0.07921 (94th percentile). No ransomware campaign use is documented.

What to do

• Update Google Chrome to 107.0.5304.87 or later, and apply the vendor's stable channel update.
• Track the CISA KEV due date (2022-11-18) and confirm remediation across all managed endpoints.
• Where Chromium-based browsers are used, apply the corresponding vendor updates; Gentoo users should follow GLSA 202305-10.
• Enforce browser auto-update and restart policies so patched versions are actually running.
• Reduce exposure by restricting browsing to trusted sites and isolating high-risk browsing where feasible.

Detection

• Monitor for Chrome processes spawning unexpected child processes or making anomalous network connections after page loads.
• Hunt for crashes or renderer instability consistent with V8 heap corruption in browser crash telemetry.
• Review web proxy and DNS logs for known exploit-hosting or malvertising domains tied to Chrome V8 exploits.
• Check endpoint inventory for Chrome versions below 107.0.5304.87 and alert on unpatched instances.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.