Chrome 0day is being exploited now for CVE-2022-1096; update immediately

It looks like this impacts all chromium-based browsers [0] which might not be obvious (was not for me anyway)<p>[0] <a href="https:&#x2F;&#x2F;msrc.microsoft.com&#x2F;update-guide&#x2F;vulnerability&#x2F;CVE-2022-1096" rel="nofollow">https:&#x2F;&#x2F;msrc.microsoft.com&#x2F;update-guide&#x2F;vulnerability&#x2F;CVE-20...</a>

Looks like these are the two commits, based on the issue number:<p><a href="https:&#x2F;&#x2F;github.com&#x2F;v8&#x2F;v8&#x2F;commit&#x2F;0981e91a4f8692af337e2588562ad1504f4bffdc" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;v8&#x2F;v8&#x2F;commit&#x2F;0981e91a4f8692af337e2588562a...</a><p><a href="https:&#x2F;&#x2F;github.com&#x2F;v8&#x2F;v8&#x2F;commit&#x2F;a2cae2180a7a6d64ccdede44d730c9fbba690fb7" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;v8&#x2F;v8&#x2F;commit&#x2F;a2cae2180a7a6d64ccdede44d730...</a><p>Although there could be others.

Looks like 99.0.4844.84 is the release we want.<p><a href="https:&#x2F;&#x2F;chromereleases.googleblog.com&#x2F;2022&#x2F;03&#x2F;stable-channel-update-for-desktop_25.html" rel="nofollow">https:&#x2F;&#x2F;chromereleases.googleblog.com&#x2F;2022&#x2F;03&#x2F;stable-channel...</a>

&gt; Not much is known, at least publicly, at this stage about CVE-2022-1096 other than it is a &quot;Type Confusion in V8.&quot; This refers to the JavaScript engine employed by Chrome.<p>Is there a safer JavaScript engine folks can use without having to worry about this sorta thing? Even if it&#x27;s slower, less compatible, more resource-intensive, etc.?<p>I feel like, in most cases, I could make due with JavaScript being 10x or even 100x slower, taking up 10x the RAM, lacking some uncommon features, and so forth -- if it meant being able to enable it without needing to worry about new zero-days.

Chromium-based versions of Microsoft Edge are also vulnerable: updating to 99.0.1150.55 fixes this CVE

Is there a site&#x2F;service&#x2F;mailing list that provides notifications for critical&#x2F;RCE&#x2F;in-the-wild exploit patches? Keeping every piece of software you run up-to-date takes a lot of work, and something like that would help with knowing what to prioritize.

I use snap for some applications in spite of the trouble it has caused me. I was super-happy to find out that it had upgraded me to a not-vulnerable verson of chromium before I even knew to look.<p>For all of the (deserved) hate snap gets, there are some shining up sides.

securing a machine that is updated regularly and runs untrusted code is not realistic, monitoring network exfil is.<p>an exploit that cannot communicate is likely benign and easy to detect in the attempt.<p>monitor all outbound network connections with a gui prompt that defaults to deny. whitelist trusted domains&#x2F;ip for a better experience and a bit less security.<p>macos has littlesnitch[1], linux has opensnitch[2], or roll your own on libnetfilterqueue[3].<p>bonus points if the filtering happens upstream at a router or wireguard host so a compromised machine cannot easily disable filtering.<p>bonus points if the filtering is at executable level granularity instead of system level.<p>1. <a href="https:&#x2F;&#x2F;www.obdev.at&#x2F;products&#x2F;littlesnitch&#x2F;index.html" rel="nofollow">https:&#x2F;&#x2F;www.obdev.at&#x2F;products&#x2F;littlesnitch&#x2F;index.html</a><p>2. <a href="https:&#x2F;&#x2F;github.com&#x2F;evilsocket&#x2F;opensnitch" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;evilsocket&#x2F;opensnitch</a><p>3. <a href="https:&#x2F;&#x2F;github.com&#x2F;nathants&#x2F;tinysnitch" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;nathants&#x2F;tinysnitch</a>

I would like to analyze the issue of browser security without controversy. The mitigations that Edge puts into practice (I&#x27;m talking about &quot;Super Duper Secure&quot; and &quot;Enhanced Security&quot;) can prevent the operation of exploits in the V8 engine like this 0-day?<p>Is this platform dependent or the mitigation in progress works well? I mean for example some feature on mac and Linux is available out of the box asACG feature.<p>This analysis is very interesting because I have only read analisys related to privacy and not about security and integrity. (I mean compare between Chorme, Edge, Brave, etc ...)

Is Chrome for android affected? And V8 in nodejs?

Type confusion in V8... May well impact Cloudflare workers too.

Anyone know if this affects Vivaldi? I assume it does since it&#x27;s chromium based, but there isn&#x27;t an update available.

Just added a bug for the Ubuntu Chromium dev PPA to update their packages: <a href="https:&#x2F;&#x2F;bugs.launchpad.net&#x2F;ubuntu&#x2F;+source&#x2F;chromium-browser&#x2F;+bug&#x2F;1966572" rel="nofollow">https:&#x2F;&#x2F;bugs.launchpad.net&#x2F;ubuntu&#x2F;+source&#x2F;chromium-browser&#x2F;+...</a>

Type confusion in V8 ... Fortunately I turned off javascript by default since Meltdown&#x2F;Spectre.

Is Electron at risk too?

why is chrome having so many updates within the past few months? is it because of coverage? (more users?). i use chrome off and on between that and firefox depending on the site and i am surprised how often i&#x27;ve been reading about issues with chrome.<p>should i switch browsers all together?

What about CloudFlare ? Does this bring to question their decision to use V8 ?

this just goes to show that updates are always 2 or so steps behind. It&#x27;s a near certainty that governments, top criminal organizations have a trove of exploits for all major programs, and new ones created after old ones get patched.

Is there a public exploit for this? Working on detecting browser exploitation myself.

Anyone know if qutebrowser is affected?

Just what the doctor ordered in the middle of a war which is also waged in the information space. Hopefully the fact that it’s in v8 will take the exploit a bit longer than usual to proliferate.

When the web &quot;standards&quot; are so insanely complicated that even Google can&#x27;t implement them securely, it&#x27;s time to admit that we have a problem.<p>When there is only one other complete implementation of these &quot;standards&quot; (with miniscule market share), it&#x27;s time to panic.