How do I check whether I am affected by CVE-2022-4262?

Open chrome://version (or edge://version, opera://about) and compare the version against the fixed release in the vendor advisory.

What is the fix for CVE-2022-4262?

Update Google Chrome, Microsoft Edge, Opera or other Chromium-based browsers to the vendor's patched release. CISA required action: apply updates per vendor instructions.

Who is not affected by CVE-2022-4262?

Not affected if: already-patched-browser.

Live › vulnerability › CVE-2022-4262

Go to dashboard

high8.8Exploited in the wildRuntime

Type confusion in V8 in Google Chrome prior to 108.0.5359.94 allowed a remote attacker to potentially exploit heap…

A type confusion bug in the V8 JavaScript engine used by Chromium lets a remote attacker corrupt heap memory by serving a crafted HTML page. Exploitation in the wild is confirmed by CISA's KEV catalog, and an attacker gets code execution in the browser process context.

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

8.8

high

scored by [email protected]

known so far5 of 6

missing: primary source

First public: Dec 2, 2022 UTC
Last modified: Jun 17, 2026
Status: open
Known exploitation: Listed in CISA KEV
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.

Why it is high, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: Yes, on CISA KEV since Dec 5, 2022.
Needs login: No.
Needs a special setup: No.
Reachable from: internet.
Worst case: Attacker runs arbitrary code in the browser after the victim visits a page.
CVSS said: 8.8. The facts above say critical; exploitation in the wild moves it to high.

Known exploitation

CISA KEV

Know the next one before it finds you.

Add to Slack

Live › vulnerability › CVE-2022-4262

Go to dashboard

high8.8Exploited in the wildRuntime

Type confusion in V8 in Google Chrome prior to 108.0.5359.94 allowed a remote attacker to potentially exploit heap…

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

8.8

high

scored by [email protected]

known so far5 of 6

missing: primary source

First public: Dec 2, 2022 UTC
Last modified: Jun 17, 2026
Status: open
Known exploitation: Listed in CISA KEV
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.

Why it is high, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: Yes, on CISA KEV since Dec 5, 2022.
Needs login: No.
Needs a special setup: No.
Reachable from: internet.
Worst case: Attacker runs arbitrary code in the browser after the victim visits a page.
CVSS said: 8.8. The facts above say critical; exploitation in the wild moves it to high.

Known exploitation

CISA KEV

Know the next one before it finds you.

Add to Slack

Product	Ecosystem	Affected	Fixed in
Google Chromium V8	vendor	–	–
google chrome	vendor	< 108.0.5359.94	108.0.5359.94

Type confusion in V8 in Google Chrome prior to 108.0.5359.94 allowed a remote attacker to potentially exploit heap…

Why it is high, and not just CVSS

Known exploitation

Know the next one before it finds you.

Type confusion in V8 in Google Chrome prior to 108.0.5359.94 allowed a remote attacker to potentially exploit heap…

Why it is high, and not just CVSS

Known exploitation

Know the next one before it finds you.

Who is affected

How to check

The fix

Who had it, and when

What the sources say, verbatim

Sources