CVE-2022-3723 is a type confusion vulnerability in Google Chromium V8. CISA added it to the Known Exploited Vulnerabilities catalogue on 28 October 2022, which means attackers have used it in real attacks. Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page.
What a type confusion bug means in Chromium V8
A type confusion vulnerability means V8 can be tricked into treating one kind of object as another kind of object. In a browser engine, that mismatch is especially dangerous because JavaScript is deeply tied to memory management and object layout, so a successful confusion can become memory corruption rather than a simple logic error.
For Chromium V8, the practical concern is that attacker-controlled code in a web page may reach engine internals through ordinary browser activity. The result is often a path from script execution to heap corruption, which can create a foundation for crashes, sandbox escape chains, or broader browser compromise depending on the rest of the exploit chain.
Why browser engine flaws are high impact
Browser engines sit at a trust boundary between untrusted web content and the local system. That makes defects in parsing, execution, or memory handling particularly sensitive, because a crafted page can become the delivery mechanism for exploitation at scale.
V8 is widely deployed inside Chromium-based browsers, so a single engine bug can affect many users and many environments at once. Security teams therefore treat browser-engine memory corruption as a high-priority class of issue, especially when the vulnerability is already known to be exploited in the wild.
For authoritative version and record details, readers should consult the CVE Program and the NIST National Vulnerability Database.
How organisations assess exposure and remediation priority
Exposure review starts with inventory: which Chromium-based browsers, embedded web runtimes, or products bundling V8 are present, and whether they are internet-facing or exposed to untrusted content. That matters because browser exploitation usually depends less on network reachability than on whether a victim can be steered to a crafted page.
Remediation priority should also reflect operational context. If patching is delayed, organisations should reduce exposure by limiting untrusted browsing, tightening browser update cadence, constraining extension use, and watching for products that embed Chromium components outside the normal desktop browser lifecycle.
The fastest way to triage whether a CVE should rise to the top of the queue is to combine internal asset knowledge with exploit-status signals in the Vulnerability Management Guide and the CISA KEV Catalogue.
Detection, compromise review, and identity impact
Detection for browser-engine exploitation is often indirect. Teams look for unexplained browser crashes, suspicious child processes, abnormal script behaviour, or downstream payload delivery that follows the initial web visit. Because the exploit occurs in a client process, post-incident review should include endpoint telemetry as well as browser logs and user activity timelines.
If exploitation is suspected, review whether the attack led to theft of cookies, session tokens, saved passwords, API keys, or authenticated browser sessions. In practice, the identity impact may be larger than the browser flaw itself, because stolen session material can outlive the original memory corruption event and let an attacker continue operations without re-exploiting the bug.
That is why browser exploit review often includes session and secret compromise patterns alongside traditional endpoint response steps.
Risk and Threat Considerations
Browser-engine type confusion is dangerous because it can turn a single malicious page load into memory corruption, code execution, or an exploit chain that crosses from web content into the local host. Once attackers can reliably corrupt heap state, they may be able to stage follow-on payloads or steal sensitive browser-held material.
Failure mechanism: A crafted HTML page drives V8 into treating memory as the wrong type, which can corrupt object metadata, pointers, or adjacent heap structures and open a path to exploitation.
Impact: The compromise can range from browser crashes to arbitrary code execution, credential or token theft, and broader endpoint intrusion if the initial foothold is paired with a second-stage payload.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8, NIST SP 800-53 Rev 5 and OWASP ASVS set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | CVE-2022-3723 requires rapid exposure review and remediation prioritisation. |
| Recommendation — Prioritise patching and compensating controls for exposed Chromium assets. | ||
| NIST SP 800-53 Rev 5 | SI-2 — Flaw Remediation | The issue is an actively exploited software flaw requiring timely remediation. |
| SI-4 — System Monitoring | Detection depends on monitoring for exploit symptoms, crashes, and suspicious post-exploitation behaviour. | |
| Recommendation — Track and remediate the V8 flaw through disciplined flaw-remediation processes. Monitor endpoint and browser telemetry for exploitation indicators and follow-on activity. | ||
| OWASP ASVS | V15 — Secure Coding and Architecture | Type confusion is a memory-safety and implementation flaw relevant to secure architecture review. |
| Recommendation — Apply secure coding and architecture review to reduce memory-corruption classes of defects. | ||
| MITRE ATT&CK | T1203 — Exploitation for Client Execution | A crafted HTML page is a client-side exploitation path leading to execution. |
| Recommendation — Map browser exploitation to client-execution techniques and hunt for initial web-delivery indicators. | ||
Practitioner Guidance
Why practitioners should care: Treat exploited browser-engine CVEs as urgent endpoint risk, not just browser maintenance. If users can reach untrusted web content, the vulnerability may be reachable even when perimeter controls look healthy.
What to watch for: Prioritise assets with internet exposure, long patch windows, embedded Chromium components, or users who handle high-value authenticated sessions. Those are the places where a V8 exploit is most likely to matter operationally.
Practitioner takeaway: In browser-engine cases, patching is necessary but not sufficient, because incident response must also assume session and secret exposure until review proves otherwise.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 17, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org