Google Patches Fifth Chrome Zero-Day of 2022 as Attacks Continue

Key points

• Google released a stable channel Chrome update on 16 August 2022, fixing 11 security flaws, including one already being exploited in the wild.
• The actively exploited flaw, CVE-2022-2856, sits in Chrome's Intents feature on Android and lets a criminal redirect a victim's browser to a malicious site through a booby-trapped webpage.
• CISA added CVE-2022-2856 to its Known Exploited Vulnerabilities catalogue and gave federal agencies a formal deadline to patch, per the CISA catalogue.
• The same update patches a critical-rated bug, CVE-2022-2852, a use-after-free flaw in Chrome's sign-in feature, scored 8.8 out of 10 for severity.
• 2022 has produced five actively exploited Chrome zero-days so far, each patched under emergency conditions.

Google pushed a security update to Chrome on 16 August 2022, closing a flaw that criminals were already using before the fix existed. That's a zero-day: a weakness the maker hadn't patched when attackers first found and used it.

The vulnerable code is Chrome's Intents system, a feature on Android that handles special links designed to open apps directly, replacing the older URI scheme approach. The flaw, CVE-2022-2856, comes down to Chrome not properly checking whether input received through those links can be trusted. Ashley Shen and Christian Resell of Google's Threat Analysis Group reported it on 19 July 2022. An attacker who exploits it can craft a webpage that, when visited, sends the victim's browser somewhere they didn't choose to go, potentially executing arbitrary code on the device.

How bad is this, really?

Bad enough that the US government issued a formal order. CISA, the federal cybersecurity agency, added CVE-2022-2856 to its Known Exploited Vulnerabilities catalogue and required every US federal agency to patch by a firm deadline. That catalogue lists only flaws with confirmed real-world exploitation.

The same update also fixes CVE-2022-2852, a use-after-free bug in FedCM, the component managing federated identity and online sign-in flows. Chrome was reading memory it had already discarded. Sergei Glazunov of Google Project Zero reported it on 8 August 2022, and NVD scores it 8.8 out of 10. No active exploitation has been confirmed, but a critical-rated browser flaw found by an internal red-team researcher isn't one to sit on. We covered a similar Project Zero-flagged Chrome engine flaw in our 4 September story on the V8 exploit.

The five zero-days of 2022, in order

All five are listed in the CISA Known Exploited Vulnerabilities catalogue.

Five exploited browser zero-days in eight months is a pace worth marking. Chrome's enormous install base makes it a permanent fixture on criminals' target lists, and each of these flaws forced Google to ship an emergency patch. That's not routine maintenance. CVE-2022-0609, the February entry, was later traced to North Korean hackers who'd been exploiting it for weeks before anyone noticed.

What should ordinary Chrome users do?

Check your version now. Open Chrome, click the three-dot menu in the top-right corner, choose Help, then About Google Chrome. If an update is available, click it. The browser restarts and the patch applies. Android users should check the Google Play Store. Edge and Opera, both built on the same Chromium code, may also be affected until their makers ship their own updates: check those separately.

Google hasn't published technical details of how the CVE-2022-2856 exploit works, which is standard practice while the patch rolls out. That delay gives defenders time to update before a working recipe appears in public documentation.