Google Rolls Out New Chrome Browser Update to Patch Yet Another Zero-Day Vulnerability

Search giant Google on Friday released an out-of-band security
update to fix a new actively exploited zero-day flaw in its Chrome
web browser.

The high-severity flaw, tracked as CVE-2022-4262^[1], concerns a type
confusion bug in the V8 JavaScript engine. Clement Lecigne of
Google’s Threat Analysis Group (TAG) has been credited with
reporting the issue on November 29, 2022.

Type confusion vulnerabilities could be weaponized by threat
actors to perform out-of-bounds memory access, or lead to a crash
and arbitrary code execution.

According to the NIST’s National Vulnerability Database, the
flaw permits^[2]
a “remote attacker to potentially exploit heap corruption via a
crafted HTML page.”

Google acknowledged active exploitation of the vulnerability but
stopped short of sharing additional specifics to prevent further
abuse.

CVE-2022-4262 is the fourth actively exploited type confusion
flaw that Google has addressed since the start of the year. It’s
also the ninth zero-day flaw in Chrome attackers have exploited in
the wild in 2022 –

Users are recommended to upgrade to version 108.0.5359.94 for
macOS and Linux and 108.0.5359.94/.95 for Windows to mitigate
potential threats.

Users of Chromium-based browsers such as Microsoft Edge, Brave,
Opera, and Vivaldi are also advised to apply the fixes as and when
they become available.