A critical zero-day vulnerability in Google Chrome has just received an emergency patch to fix a type confusion bug in the V8 JavaScript engine, which processes JavaScript in Chrome and Microsoft Edge browser instances. This type confusion vulnerability manifests when an application processes JavaScript instructions and operations for a specific type of input, but is tricked by the attacker into processing an incorrect type, which leads to an application memory error, allowing the attacker to execute arbitrary malicious code. This vulnerability, tracked as CVE-2022-1096, has been exploited in-the-wild, and Cyber Threat Cognitive Intel (CTCI) researchers identified the flaw being exploited on March 20, 2022. The researchers stated that “additional intelligence was found during the attack analysis on 3/25/2022, where we identified a phishing scam against a honey client that is used to identify client-side attacks on users within the crypto space. The initial vector was a Discord channel.” This campaign has not been officially attributed to a specific threat actor; however, Google’s Threat Analysis Group did identify and attribute two different state-sponsored North Korean campaigns (Operation Dream Job and Operation AppleJeus) exploiting similar Chrome vulnerabilities in early February 2022. This flaw has been patched in both Chrome and Edge, and users are urged to ensure they are running the most up to date instance of their browsers.