Chrome 0day is being exploited now for CVE-2022-1096; update immediately
1–10 of 150 posts
Re: Chrome 0day is being exploited now for CVE-2022-1096; update immediately
#2> Not much is known, at least publicly, at this stage about CVE-2022-1096 other than it is a "Type Confusion in V8." This refers to the JavaScript engine employed by Chrome.
Is there a safer JavaScript engine folks can use without having to worry about this sorta thing? Even if it's slower, less compatible, more resource-intensive, etc.?
I feel like, in most cases, I could make due with JavaScript being 10x or even 100x slower, taking up 10x the RAM, lacking some uncommon features, and so forth -- if it meant being able to enable it without needing to worry about new zero-days.
Re: Chrome 0day is being exploited now for CVE-2022-1096; update immediately
#3Just what the doctor ordered in the middle of a war which is also waged in the information space. Hopefully the fact that it’s in v8 will take the exploit a bit longer than usual to proliferate.
Re: Chrome 0day is being exploited now for CVE-2022-1096; update immediately
#4> Not much is known, at least publicly, at this stage about CVE-2022-1096 other than it is a "Type Confusion in V8." This refers to the JavaScript engine employed by Chrome. Is there a safer JavaScript engine folks can use without having to worry about this sorta thing? Even if it's slower, less compatible, more resource-intensive, etc.? I feel like, in most cases, I could make due with JavaScript being 10x or even 1…
Microsoft has added some mitigtions to Edge a few months ago as defense in depth - wondering now if this is actually exploitable on Edge or if their mitigations prevent it? Any Microsoft/Edge security people on here?
Update: found the original blog from Microsoft, they call it Super Duper Secure Mode: https://microsoftedge.github.io/edgevr/posts/Super-Duper-Sec...
Re: Chrome 0day is being exploited now for CVE-2022-1096; update immediately
#5Just what the doctor ordered in the middle of a war which is also waged in the information space. Hopefully the fact that it’s in v8 will take the exploit a bit longer than usual to proliferate.
No post body was provided.
Re: Chrome 0day is being exploited now for CVE-2022-1096; update immediately
#6Chromium-based versions of Microsoft Edge are also vulnerable: updating to 99.0.1150.55 fixes this CVE
Re: Chrome 0day is being exploited now for CVE-2022-1096; update immediately
#7this just goes to show that updates are always 2 or so steps behind. It's a near certainty that governments, top criminal organizations have a trove of exploits for all major programs, and new ones created after old ones get patched.
Re: Chrome 0day is being exploited now for CVE-2022-1096; update immediately
#8It looks like this impacts all chromium-based browsers [0] which might not be obvious (was not for me anyway)
[0] https://msrc.microsoft.com/update-guide/vulnerability/CVE-20...
Re: Chrome 0day is being exploited now for CVE-2022-1096; update immediately
#9When the web "standards" are so insanely complicated that even Google can't implement them securely, it's time to admit that we have a problem.
When there is only one other complete implementation of these "standards" (with miniscule market share), it's time to panic.
Re: Chrome 0day is being exploited now for CVE-2022-1096; update immediately
#10When the web "standards" are so insanely complicated that even Google can't implement them securely, it's time to admit that we have a problem. When there is only one other complete implementation of these "standards" (with miniscule market share), it's time to panic.
There is no indication yet that this is due to complex web standards. It could be, but we literally dont know what the bug is yet.