CVE-2022-3723: Google Chromium V8 Type Confusion Vulnerability

Vulnerability summary

CVE-2022-3723 is a high (CVSS 8.8) Type Confusion vulnerability in Google Chromium V8. It is known to be exploited: CISA lists it, first on 28-10-2022. EPSS estimates a 7.92% chance of exploitation in the next 30 days, higher than 94.6% of scored vulnerabilities.

Timeline

1. 28-10-2022
   Added to CISA KEVGoogle Chromium V8 Type Confusion Vulnerability
2. 01-11-2022
   PublishedVulnerability first disclosed.
3. 18-11-2022
   CISA remediation dueApply updates per vendor instructions.
4. 21-10-2025
   Last modifiedVulnerability information updated.

Description

Type confusion in V8 in Google Chrome prior to 107.0.5304.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

• CWE-843Access of Resource Using Incompatible Type ('Type Confusion')The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.