Google has released an urgent security update for the Chrome browser to patch a critical zero-day vulnerability that is being actively exploited in-the-wild. This flaw, tracked as CVE-2022-3723, is described as a type confusion vulnerability within the Chrome V8 JavaScript engine. MITRE explains that type confusion vulnerabilities occur when a program “allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.” Malicious threat actors could exploit this vulnerability to access memory locations that shouldn’t be reachable, allowing them to pilfer sensitive data, cause a system crash, or perform arbitrary code execution within the vulnerable application. This vulnerability was reported to Google by Avast researchers on October 25, 2022. Google is currently withholding the details of the exploit as well as what kind of threat actors are exploiting it to allow as much of the Chrome user base as possible to implement the latest patch. Google has stated that if the flaw exists in a third-party library that other projects depend on, they will continue to restrict the details until those libraries have mitigated this flaw. This is the seventh (7) zero-day vulnerability in 2022 for Google Chrome, and the third (3) type confusion vulnerability in the V8 JavaScript engine this year. CTIX analysts urge all Chrome and Chromium (Microsoft Edge, Brave, Opera, Vivaldi, etc.) users to ensure that they have implemented this latest patch and are running version 107.0.5304.87 for macOS/Linux and 107.0.5304.87/.88 for Windows.