New Chrome Browser Update to Patch Yet Another Zero-Day Vulnerability (CVE-2022-4262)

New Browser-in-the-Browser (BitB) Attack Steal User Credentials

VTA-00428 – New Chrome Browser Update to Patch Yet Another Zero-Day Vulnerability (CVE-2022-4262)

Recently, Google has released an out-of-band security update to fix a new actively exploited zero-day flaw in its Chrome web browser.

The high-severity flaw, tracked as CVE-2022-4262, concerns a type confusion bug in the V8 JavaScript engine. Clement Lecigne of Google’s Threat Analysis Group (TAG) has been credited with reporting the issue on November 29, 2022.

Type confusion vulnerabilities could be weaponized by threat actors to perform out-of-bounds memory access or lead to a crash and arbitrary code execution.

According to the NIST’s National Vulnerability Database, the flaw permits a “remote attacker to potentially exploit heap corruption via a crafted HTML page.”

Users are recommended to upgrade to version 108.0.5359.94 for macOS and Linux and 108.0.5359.94/.95 for Windows to mitigate potential threats.Users of Chromium-based browsers such as Microsoft Edge, Brave, Opera, and Vivaldi are also advised to apply the fixes as and when they become available.


Attack Surfaces:
Web Application

Execution, Initial Access

External Remote Service, Command and Scripting Interpreter, Web Service

Active Defense Tactics:

Active Defense Techniques:

Indicator of Compromise:

SuperPRO’s Threat Countermeasures Procedures: 
1. Upgrade Chrome browser to the latest version
– macOS and Linux (108.0.5359.94)
– Windows (108.0.5359.94/.95)
2. It is recommended to upgrade other Chromium-based browser to the latest version when available
– Microsoft Edge
– Brave
– Opera
– Vivaldi.

Contributed by:  S1mps0n5

Leave a Reply

Your email address will not be published. Required fields are marked *

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <s> <strike> <strong>