Threat Intelligence Alert 28.03.22 - Exploit Available for Chrome and Edge V8 Type Confusion Vulnerability in the Wild.txt

Exploit Available for Chrome and Edge V8 Type Confusion Vulnerability in the Wild

Key Details
CVE-2022-1096
Affected Products – (Chromium Browsers) Google Chrome, Microsoft Edge
Disclosure Date – 26th March 2022
CVSS Score – N/A
Exploit Released - Yes
Patch Available – Yes

Summary
Google have warned of a critical vulnerability for Chromium browsers that has an exploit available in the wild, and thus are urging users of the browsers on
Windows, macOS and Linux to update as soon as possible. The vulnerability in question is CVE-2022-1096 which is a type confusion vulnerability found in Chromes
V8 JavaScript engine, and was reported by an anonymous user on 23/03/2022. Google are expected to remain silent on the technical details of the vulnerability
until the vast majority of users have installed stable channel 99.0.4844.84 for Chrome or 99.0.1150.55 for Edge.

Mitigation
Windows, macOS, and Linux users to update Chrome builds to version 99.0.4844.84 and/or Edge version 99.0.1150.55. Google will be pushing these patches out
automatically over the coming weeks, but those wishing to patch immediately can manually do so by following the instructions on the following links:

Chrome: https://support.google.com/chrome/answer/95414?hl=en-GB&co=GENIE.Platform%3DDesktop 
Edge: https://support.microsoft.com/en-us/topic/microsoft-edge-update-settings-af8aaca2-1b69-4870-94fe-. 

NCC Group Actions
NCC Group will continue to track this vulnerability and will update this alert with any critical developments and any emerging IoC’s will be identified and added to our Threat Intelligence Platform for monitoring.

Sources
https://www.zdnet.com/article/chrome-and-edge-hit-with-v8-type-confusion-vulnerability-with-in-the-wild-exploit/
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-1096
https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop_25.html