CVE-2022-1096

Exploited in the Wild ✓ Confirmed 0-Day ★ Google Project Zero
Triaged: March 3, 2026 14 articles
VulnLookup ↗ NVD ↗ MITRE ↗ Advisory ↗ P0 Sheet ↗ CISA KEV ↗

EPSS Score

Source: FIRST.org · 2026-05-24
37.66%
probability
This CVE has a 37.66% probability of being exploited in the next 30 days.
0% Top 97.3th percentile of all CVEs 100%
CVSS score unavailable
Neither CIRCL nor NVD returned a CVSS score for this CVE. View on VulnerabilityLookup ↗

Description

Project Zero
Type confusion in V8

Attack Intelligence

Google Project Zero

Discovered
March 23, 2022
Patched
March 25, 2022
Reported by
???
Root Cause Analysis
https://googleprojectzero.github.io/0days-in-the-wild//0day-RCAs/2022/CVE-2022-1096.html

Exploits & PoC

Mav3r1ck0x1/Chrome-and-Edge-Version-Dumper

Powershell script that dumps Chrome and Edge version to a text file in order to determine if you need to update due to CVE-2022-1096

3
1 repo — triés par ⭐ Rechercher sur GitHub ↗

Signal Intelligence

Confidenceⓘ
85%
EPSS 37.66%
Mentions 14
Last Seen Apr 18, 2023

CNA Information

Analyst Note

CVE-2022-1096 is a high-severity type confusion vulnerability in Chrome V8 with confirmed Google Project Zero involvement and official vendor patching in version 99.0.4844.84, providing strong evidence of legitimacy. The CVSS 8.8 rating reflects significant heap corruption exploitation potential. While limited public article coverage exists, the combination of Google's acknowledgment, Project Zero research, and official patching strongly validates the confirmed classification.

Threat Actors 3

Cobalt
apt_group Financial crime 🇷🇺 RU
Luna Moth
apt_group
Operation Cobalt Whisper
apt_group Financial crime 🇨🇳 CN

Triage Info

Decided atMar 03, 2026