Vulnerability record · CVE-2022-4262 · published 2 December 2022
CVE-2022-4262: Google Chrome V8 type confusion allows heap corruption
Google · Chrome
Google Chrome before 108.0.5359.94 contains a type confusion flaw in the V8 JavaScript engine. A crafted HTML page can trigger the confusion and potentially corrupt the heap, which matters because Chrome is widely deployed and the flaw was exploited in the wild.
Description
Type confusion in V8 in Google Chrome prior to 108.0.5359.94 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Automated analysis
high priorityRemote code execution potential in a widely used browser combined with confirmed exploitation in CISA KEV.
What it is
Google Chrome before 108.0.5359.94 contains a type confusion flaw in the V8 JavaScript engine. A crafted HTML page can trigger the confusion and potentially corrupt the heap, which matters because Chrome is widely deployed and the flaw was exploited in the wild.
Impact
An attacker who gets the page rendered may achieve heap corruption, which can lead to code execution or a crash in the browser process. The CVSS vector rates confidentiality, integrity and availability impact as high.
Attack surface
Reached over the network by loading a crafted HTML page; no privileges are required but user interaction (opening the page) is needed per the CVSS vector. No authentication is required.
Exploitation
Listed in CISA KEV with a 2022-12-26 remediation due date, indicating known exploitation. EPSS 30-day probability is about 0.16 (96.7th percentile), and references include a vendor patch and the KEV entry.
What to do
- Update Chrome to 108.0.5359.94 or later per the vendor release notes.
- Apply the same Chromium fix to other Chromium-based browsers and embedded Chromium components.
- Enforce browser auto-update and verify version compliance across endpoints.
- Restrict or monitor browsing to untrusted sites where feasible until patching completes.
Detection
- Alert on Chrome versions below 108.0.5359.94 in asset inventory or endpoint telemetry.
- Hunt for browser crashes or renderer process terminations consistent with heap corruption.
- Monitor network and proxy logs for delivery of exploit pages to unpatched Chrome clients.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2022-4262 to the Known Exploited Vulnerabilities catalog on 5 December 2022 as "Google Chromium V8 Type Confusion Vulnerability". Required action: Apply updates per vendor instructions. Federal deadline 26 December 2022.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://chromereleases.googleblog.com/2022/12/stable-channel-update-for-desktop.html | PatchRelease NotesVendor Advisory |
| https://crbug.com/1394403 | Permissions RequiredVendor Advisory |
| https://chromereleases.googleblog.com/2022/12/stable-channel-update-for-desktop.html | PatchRelease NotesVendor Advisory |
| https://crbug.com/1394403 | Permissions RequiredVendor Advisory |
| https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-4262 | US Government Resource |
Track CVE-2022-4262 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2022-4262), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
