Google released an emergency update to patch a critical zero-day vulnerability in their Chrome browser that has been exploited in-the-wild. The flaw was reported to Google by their own Threat Analysis Group (TAG). Shortly after observing exploitation attempts, the flaw was added to the Cybersecurity and Infrastructure Security Agency’s (CISA) Known Exploited Vulnerabilities (KEV) catalog. The vulnerability, tracked as CVE-2022-4262, is a type confusion bug in the Google Chrome V8 JavaScript engine. Type confusion occurs when programs allocate or initialize a resource such as a pointer, object, or variable using one type but later accesses that resource using a different type that is incompatible with the original. This triggers logical errors due to the resource not having properties which are expected from it and languages without memory safety could experience out-of-bounds memory access. This could lead to system crashes and even arbitrary code execution through exploitation. This flaw could be leveraged by threat actors to pilfer sensitive information, make changes to configurations, and create new privileged accounts from which they could mount follow-on attacks. At this time, there is currently very limited information about the technical details of the exploit or the threat actors exploiting it. This is to allow as many Chrome users as possible to patch the vulnerability before a working proof-of-concept (PoC) is published. The presence of this vulnerability on the KEV dictates that to be compliant, all Federal Civilian Executive Branch (FCEB) agencies must ensure this flaw is patched by no later than December 26, 2022. Due to Google’s patching schema, Chrome browsers should automatically update when the browser is restarted. CTIX analysts recommend that all Chrome users check their browser settings to ensure they are not vulnerable to exploitation.