Type confusion in V8 in Google Chrome prior to 112.0.5615.121 allowed a remote attacker to potentially exploit heap corruption via a crafted

Summary

Google Chrome's V8 JavaScript engine is affected, allowing a remote attacker who lures a user to a specially crafted HTML page to potentially corrupt heap memory. Successful exploitation could let an attacker compromise the browser and possibly the affected system.

Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.

Timeline

1. Apr 14, 2023, 6:10 PM UTCCVE published
2. Apr 17, 2023Added to CISA KEV

   CISA has evidence of exploitation in the wild

3. May 8, 2023CISA remediation deadline

   Due date for US federal agencies to patch

4. Oct 21, 2025, 11:05 PM UTCRecord last updated
5. Oct 22, 2026EPSS reached 10%

   FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

• Google Chrome

  From 112.0.5615.121 · fixed in 112.0.5615.121

References 11