Loading vulnerability…
CVE-2022-1364 is a type confusion vulnerability in the V8 JavaScript engine’s Turbofan optimizing compiler in Google Chrome prior to 100.0.4896.127. The flaw can be triggered by a crafted HTML page and may lead to heap corruption in the renderer process. Available technical context indicates the bug was exploited through a JIT optimization issue involving leakage of V8’s internal TheHole value into JavaScript, which could then be abused through Set and Map operations on holey structures to achieve an out-of-bounds write, corrupt array metadata, and derive fakeobj, addrof, and arbitrary read/write primitives. In demonstrated exploitation, attackers used those primitives to place shellcode into JIT-compiled WebAssembly code and execute it within the browser renderer.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos.
This repository contains a working exploit for CVE-2022-1364, a remote code execution (RCE) vulnerability in the V8 JavaScript engine as used by UC Browser on Android. The exploit is implemented in JavaScript and is intended to be run in the context of the vulnerable browser, typically by luring a user to a malicious web page. The exploit achieves arbitrary memory read/write, patches memory protections to allow execution of injected shellcode, and ultimately achieves code execution within the browser process. Additionally, the payload includes functionality to exfiltrate the DOM structure of the current page to a remote server (https://192.168.1.246:5000/api/message) via HTTP POST requests every 3 seconds. The repository consists of two main JavaScript files (exploit.js and cleanup_exp.js), which are nearly identical and contain the full exploit logic, and a README.md that provides context and references. The exploit targets UC Browser versions prior to a late 2024 patch and is specific to ARM64 devices running Android.
This repository contains a browser exploit targeting Bromite v95.0.4638.79 (arm_ChromePublic.apk) as indicated in the readme. The main file, 'exp.html', is a standalone HTML/JavaScript exploit. The exploit leverages JavaScript engine vulnerabilities to achieve out-of-bounds access and arbitrary read/write primitives. It then abuses WebAssembly to obtain a region of RWX (read-write-execute) memory, into which it injects shellcode (in this case, a placeholder shellcode array). The exploit demonstrates the ability to execute arbitrary code in the browser context. The code is operational and includes all necessary primitives for exploitation, but the shellcode is minimal and would need to be replaced for a real-world payload. There are no hardcoded network endpoints or external resources; the exploit is self-contained and intended to be loaded in a vulnerable browser. The repository structure is simple, with only the exploit HTML file and a brief readme specifying the tested environment.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A Chrome V8/TurboFan JIT optimization vulnerability that leaks TheHole into JavaScript and can be exploited for out-of-bounds write and arbitrary read/write, enabling remote code execution on the Kindle browser.
Another Chrome/V8 vulnerability referenced as an example of a flaw that could leak TheHole, prompting additional hardening to prevent renderer exploitation.
Another vulnerability referenced as an example of a bug that could leak the V8 TheHole value, prompting Google to harden protections against TheHole-based renderer exploitation.
A vulnerability in Chromium's v8 engine, exploited in the wild in 2022, and a variant of a previous vulnerability (CVE-2021-21195).
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.