CVE-2022-3723
Google Chromium V8 Type Confusion Vulnerability
Description
CVE-2022-3723 is a type confusion vulnerability in the V8 JavaScript engine used by Google Chrome, affecting versions prior to 107.0.5304.87. This type confusion weakness (CWE-843) allows a remote attacker to potentially exploit heap corruption through a specially crafted HTML page, which could lead to arbitrary code execution within the Chrome renderer process. The vulnerability requires the victim to visit a malicious web page, making it exploitable via standard web-based attack delivery. CISA has added CVE-2022-3723 to its Known Exploited Vulnerabilities catalog with a remediation deadline of November 18, 2022, confirming active exploitation in the wild.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| chrome | < 107.0.5304.87 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://chromereleases.googleblog.com/2022/10/stable-channel-update-for-desktop_27.html(Release Notes, Vendor Advisory)
- https://crbug.com/1378239(Permissions Required)
- https://security.gentoo.org/glsa/202305-10(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-3723(US Government Resource)
Weakness Type
CWE-843: Access of Resource Using Incompatible Type (Type Confusion)
CWE-843 describes a weakness where code accesses a resource using a type that is incompatible with the type it was originally created as, leading to incorrect memory interpretation. In CVE-2022-3723, V8's JavaScript engine misidentifies the type of a JavaScript object, causing it to treat the object's memory layout incorrectly and potentially enabling heap corruption through controlled memory operations.
Learn more: CWE-843 — Access of Resource Using Incompatible Type
Impact Analysis
CVE-2022-3723 carries a CVSS 3.1 score of 8.8 (High), reflecting its significant real-world exploitability. Attack Vector (Network): this vulnerability is remotely exploitable — an attacker can deliver the exploit simply by luring a victim to a malicious web page, requiring no physical or network adjacency. Attack Complexity (Low): no special conditions or race conditions are required; a crafted HTML page is sufficient to trigger the type confusion. Privileges Required (None): the attacker needs no special permissions or account access. User Interaction (Required): a victim must visit the malicious page or open a crafted link, which is trivially achievable through phishing or malvertising. Confidentiality, Integrity, and Availability (all High): successful exploitation can result in heap corruption and potential code execution within the Chrome renderer process, giving an attacker access to browser memory, session data, and potentially the ability to escape to the underlying operating system via further exploit chaining. The EPSS score of 0.523% at the 66th percentile, combined with KEV status, confirms this vulnerability has seen real exploitation activity.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2022-3723 by including it in the Known Exploited Vulnerabilities catalog, with a remediation deadline of November 18, 2022 — just days after the patch was released, indicating rapid weaponization. No exploit-tagged reference URLs are present in the available references, as the Chromium bug tracker entry (crbug.com/1378239) requires permissions to access. The EPSS score of 0.523% (66th percentile) indicates above-average exploitation activity relative to the broader CVE population. Type confusion vulnerabilities in V8 are a well-known class of Chrome browser exploits that have historically been used in drive-by download attacks and exploit kits targeting end users.
Remediation
- Update Google Chrome to version 107.0.5304.87 or later — Google released a fix for CVE-2022-3723 in Chrome stable channel update 107.0.5304.87 on October 27, 2022. Apply this update immediately across all managed endpoints.
- If the update cannot be applied, discontinue use — Per CISA's KEV required action: "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable." Consider switching to an alternative browser temporarily if Chrome cannot be updated.
- Enable automatic browser updates — Configure Chrome's automatic update mechanism (or your enterprise software deployment system) to ensure browser updates are applied within 24–48 hours of release.
- Deploy web filtering and safe browsing controls — Enable Chrome's Enhanced Safe Browsing feature and use a web proxy or DNS filtering service to block access to known malicious domains that may be hosting exploit pages.
- Monitor for suspicious browser activity — Review endpoint detection logs for unusual Chrome process behavior, unexpected child process spawning, or connections to suspicious external hosts following browser activity, which may indicate exploitation.
Technical Details
CVE-2022-3723 is a type confusion vulnerability (CWE-843) in V8, Google Chrome's high-performance JavaScript and WebAssembly engine. Type confusion in V8 occurs when the engine's internal object type system is manipulated through crafted JavaScript such that an object of one type is subsequently accessed as though it were a different type with a different memory layout. This misinterpretation allows an attacker to craft JavaScript that reads from or writes to heap memory at attacker-controlled offsets, potentially corrupting adjacent objects or function pointers. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H shows the attack is delivered over the network via a crafted HTML page requiring only that the user visit it. While the scope remains unchanged (S:U), code execution within the Chrome renderer can often be chained with a sandbox escape vulnerability to achieve full OS-level code execution. Chromium classified this as High severity in its internal security severity rating.
Frequently Asked Questions
Is CVE-2022-3723 being actively exploited?
Yes. CISA has confirmed active exploitation of CVE-2022-3723 by adding it to the Known Exploited Vulnerabilities catalog. The remediation deadline of November 18, 2022 indicates that exploitation was occurring in the wild around the time of the patch release. Users who have not updated Chrome to version 107.0.5304.87 or later remain at risk.
What products are affected by CVE-2022-3723?
CVE-2022-3723 affects Google Chrome versions prior to 107.0.5304.87 on all supported desktop platforms (Windows, macOS, Linux). The vulnerability is specifically in the V8 JavaScript engine, which is also used in Chromium-based browsers, though KEV tracking focuses on Google Chrome.
How do I fix CVE-2022-3723?
Update Google Chrome to version 107.0.5304.87 or later. This update was released on October 27, 2022 in the stable channel. Enterprise administrators should push this update via their software deployment tools. Chrome typically auto-updates, but users should verify by checking chrome://settings/help.
How severe is CVE-2022-3723?
CVE-2022-3723 has a CVSS 3.1 score of 8.8 (High severity), reflecting that it is remotely exploitable via a crafted web page with no authentication required. The EPSS score of 0.523% places it at the 66th percentile for exploitation probability, and CISA's KEV inclusion confirms real-world exploitation. Successful exploitation can lead to heap corruption and arbitrary code execution within Chrome.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.