CVE-2022-1364: Google Chromium V8 Type Confusion Vulnerability

CVE-2022-1364 · Severity: critical · CVSS 8.8 · Exploited in the wild · Published 2022-04-15

A type confusion vulnerability in the V8 Turbofan engine of Google Chromium allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability was reported as being exploited in the wild at the time of disclosure.

Technologies: Google Chromium V8. Vendors: Google.

Quick answers

Is CVE-2022-1364 exploited in the wild?
Yes. CVE-2022-1364 is known to be exploited in the wild, first recorded on 15 April 2022. Treat it as urgent.
How severe is CVE-2022-1364?
Critical severity, with a CVSS score of 8.8, published 15 April 2022.
Which products and versions are affected?
Google Chrome prior to 100.0.4896.127; Microsoft Edge; Opera Software Opera.
Is there a fix for CVE-2022-1364?
A patch was published on 2022-04-14: Stable channel update for desktop released (100.0.4896.127) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2022-1364 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2022-1364?
Check whether you run Google Chromium V8. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Affected products

  • Google Chrome prior to 100.0.4896.127
  • Microsoft Edge
  • Opera Software Opera

Timeline

  • 2022-04-14: patched: Stable channel update for desktop released (100.0.4896.127)
  • 2022-04-15: disclosed: Initial publication date
  • 2022-04-15: kev added: Added to CISA Known Exploited Vulnerabilities Catalog
  • 2022-04-15: exploited: Reported as exploited in the wild

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.