ByteOS

Product:iOS

Added At:14 Dec, 2022

Due At:04 Jan, 2023

Apple iOS Type Confusion Vulnerability

Apple iOS contains a type confusion vulnerability when processing maliciously crafted web content leading to code execution.

Used in Ransomware

Unknown

CWE

CWE-843

Required Action:

Apply updates per vendor instructions.

Additional Notes:

https://support.apple.com/en-us/HT213516; https://nvd.nist.gov/vuln/detail/CVE-2022-42856

▼Common Vulnerabilities and Exposures (CVE)

cve.org

Assigner:apple

Assigner Org ID:286789f9-fbc2-4510-9f9a-43facdede74c

Published At:15 Dec, 2022 | 00:00

Updated At:21 Oct, 2025 | 23:15

▼CVE Numbering Authority (CNA)

A type confusion issue was addressed with improved state handling. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 15.7.2 and iPadOS 15.7.2, iOS 16.1.2. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.1..

From unspecified before 16.2 (custom)

Problem Types

Type	CWE ID	Description
text	N/A	Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.1.

Type: text

CWE ID: N/A

Description: Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.1.

References

Hyperlink	Resource
https://support.apple.com/en-us/HT213535	N/A
https://support.apple.com/en-us/HT213532	N/A
https://support.apple.com/en-us/HT213531	N/A
https://support.apple.com/en-us/HT213516	N/A
https://support.apple.com/en-us/HT213537	N/A
http://seclists.org/fulldisclosure/2022/Dec/21	mailing-list
http://seclists.org/fulldisclosure/2022/Dec/23	mailing-list
http://seclists.org/fulldisclosure/2022/Dec/22	mailing-list
http://seclists.org/fulldisclosure/2022/Dec/26	mailing-list
http://seclists.org/fulldisclosure/2022/Dec/28	mailing-list
http://www.openwall.com/lists/oss-security/2022/12/26/1	mailing-list
https://security.gentoo.org/glsa/202305-32	N/A

Hyperlink: https://support.apple.com/en-us/HT213535

Resource: N/A

Hyperlink: https://support.apple.com/en-us/HT213532

Resource: N/A

Hyperlink: https://support.apple.com/en-us/HT213531

Resource: N/A

Hyperlink: https://support.apple.com/en-us/HT213516

Resource: N/A

Hyperlink: https://support.apple.com/en-us/HT213537

Resource: N/A

Hyperlink: http://seclists.org/fulldisclosure/2022/Dec/21

Resource:

mailing-list

Hyperlink: http://seclists.org/fulldisclosure/2022/Dec/23

Resource:

mailing-list

Hyperlink: http://seclists.org/fulldisclosure/2022/Dec/22

Resource:

mailing-list

Hyperlink: http://seclists.org/fulldisclosure/2022/Dec/26

Resource:

mailing-list

Hyperlink: http://seclists.org/fulldisclosure/2022/Dec/28

Resource:

mailing-list

Hyperlink: http://www.openwall.com/lists/oss-security/2022/12/26/1

Resource:

mailing-list

Hyperlink: https://security.gentoo.org/glsa/202305-32

Resource: N/A

▼Authorized Data Publishers (ADP)

1. CVE Program Container

References

Hyperlink	Resource
https://support.apple.com/en-us/HT213535	x_transferred
https://support.apple.com/en-us/HT213532	x_transferred
https://support.apple.com/en-us/HT213531	x_transferred
https://support.apple.com/en-us/HT213516	x_transferred
https://support.apple.com/en-us/HT213537	x_transferred
http://seclists.org/fulldisclosure/2022/Dec/21	mailing-list x_transferred
http://seclists.org/fulldisclosure/2022/Dec/23	mailing-list x_transferred
http://seclists.org/fulldisclosure/2022/Dec/22	mailing-list x_transferred
http://seclists.org/fulldisclosure/2022/Dec/26	mailing-list x_transferred
http://seclists.org/fulldisclosure/2022/Dec/28	mailing-list x_transferred
http://www.openwall.com/lists/oss-security/2022/12/26/1	mailing-list x_transferred
https://security.gentoo.org/glsa/202305-32	x_transferred

Hyperlink: https://support.apple.com/en-us/HT213535

Resource:

x_transferred

Hyperlink: https://support.apple.com/en-us/HT213532

Resource:

x_transferred

Hyperlink: https://support.apple.com/en-us/HT213531

Resource:

x_transferred

Hyperlink: https://support.apple.com/en-us/HT213516

Resource:

x_transferred

Hyperlink: https://support.apple.com/en-us/HT213537

Resource:

x_transferred

Hyperlink: http://seclists.org/fulldisclosure/2022/Dec/21

Resource:

mailing-list

x_transferred

Hyperlink: http://seclists.org/fulldisclosure/2022/Dec/23

Resource:

mailing-list

x_transferred

Hyperlink: http://seclists.org/fulldisclosure/2022/Dec/22

Resource:

mailing-list

x_transferred

Hyperlink: http://seclists.org/fulldisclosure/2022/Dec/26

Resource:

mailing-list

x_transferred

Hyperlink: http://seclists.org/fulldisclosure/2022/Dec/28

Resource:

mailing-list

x_transferred

Hyperlink: http://www.openwall.com/lists/oss-security/2022/12/26/1

Resource:

mailing-list

x_transferred

Hyperlink: https://security.gentoo.org/glsa/202305-32

Resource:

x_transferred

2. CISA ADP Vulnrichment

Problem Types

Type	CWE ID	Description
CWE	CWE-843	CWE-843 Access of Resource Using Incompatible Type ('Type Confusion')

Type: CWE

CWE ID: CWE-843

Description: CWE-843 Access of Resource Using Incompatible Type ('Type Confusion')

Metrics

Version	Base score	Base severity	Vector
3.1	8.8	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Version: 3.1

Base score: 8.8

Base severity: HIGH

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Metrics Other Info

kev

dateAdded:

2022-12-14

reference:

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-42856

Timeline

Event	Date
CVE-2022-42856 added to CISA KEV	2022-12-14 00:00:00

Event: CVE-2022-42856 added to CISA KEV

Date: 2022-12-14 00:00:00

References

Hyperlink	Resource
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-42856	government-resource

Hyperlink: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-42856

Resource:

government-resource

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:product-security@apple.com

Published At:15 Dec, 2022 | 19:15

Updated At:23 Oct, 2025 | 18:02

CISA Catalog

Date Added	Due Date	Vulnerability Name	Required Action
2022-12-14	2023-01-04	Apple iOS Type Confusion Vulnerability	Apply updates per vendor instructions.

Date Added: 2022-12-14

Due Date: 2023-01-04

Vulnerability Name: Apple iOS Type Confusion Vulnerability

Required Action: Apply updates per vendor instructions.

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	8.8	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Secondary	3.1	8.8	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Type: Primary

Version: 3.1

Base score: 8.8

Base severity: HIGH

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Type: Secondary

Version: 3.1

Base score: 8.8

Base severity: HIGH

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CPE Matches

cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*

>>safari>>Versions before 16.2(exclusive)

cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*

>>ipados>>Versions before 15.7.2(exclusive)

cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*

>>iphone_os>>Versions before 15.7.2(exclusive)

cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*

>>iphone_os>>Versions from 16.0(inclusive) to 16.1.2(exclusive)

cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*

>>macos>>Versions before 13.1(exclusive)

cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*

>>tvos>>Versions before 16.2(exclusive)

Weaknesses

CWE ID	Type	Source
CWE-843	Primary	nvd@nist.gov
CWE-843	Secondary	134c704f-9b21-4f2e-91b3-4a467353bcc0

CWE ID: CWE-843

Type: Primary

Source: nvd@nist.gov

CWE ID: CWE-843

Type: Secondary

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

References

Hyperlink	Source	Resource
http://seclists.org/fulldisclosure/2022/Dec/21	product-security@apple.com	Mailing List Third Party Advisory
http://seclists.org/fulldisclosure/2022/Dec/22	product-security@apple.com	Mailing List Third Party Advisory
http://seclists.org/fulldisclosure/2022/Dec/23	product-security@apple.com	Mailing List Third Party Advisory
http://seclists.org/fulldisclosure/2022/Dec/26	product-security@apple.com	Mailing List Third Party Advisory
http://seclists.org/fulldisclosure/2022/Dec/28	product-security@apple.com	Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2022/12/26/1	product-security@apple.com	Mailing List Third Party Advisory
https://security.gentoo.org/glsa/202305-32	product-security@apple.com	Third Party Advisory
https://support.apple.com/en-us/HT213516	product-security@apple.com	Release Notes Vendor Advisory
https://support.apple.com/en-us/HT213531	product-security@apple.com	Release Notes Vendor Advisory
https://support.apple.com/en-us/HT213532	product-security@apple.com	Release Notes Vendor Advisory
https://support.apple.com/en-us/HT213535	product-security@apple.com	Release Notes Vendor Advisory
https://support.apple.com/en-us/HT213537	product-security@apple.com	Release Notes Vendor Advisory
http://seclists.org/fulldisclosure/2022/Dec/21	af854a3a-2127-422b-91ae-364da2661108	Mailing List Third Party Advisory
http://seclists.org/fulldisclosure/2022/Dec/22	af854a3a-2127-422b-91ae-364da2661108	Mailing List Third Party Advisory
http://seclists.org/fulldisclosure/2022/Dec/23	af854a3a-2127-422b-91ae-364da2661108	Mailing List Third Party Advisory
http://seclists.org/fulldisclosure/2022/Dec/26	af854a3a-2127-422b-91ae-364da2661108	Mailing List Third Party Advisory
http://seclists.org/fulldisclosure/2022/Dec/28	af854a3a-2127-422b-91ae-364da2661108	Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2022/12/26/1	af854a3a-2127-422b-91ae-364da2661108	Mailing List Third Party Advisory
https://security.gentoo.org/glsa/202305-32	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory
https://support.apple.com/en-us/HT213516	af854a3a-2127-422b-91ae-364da2661108	Release Notes Vendor Advisory
https://support.apple.com/en-us/HT213531	af854a3a-2127-422b-91ae-364da2661108	Release Notes Vendor Advisory
https://support.apple.com/en-us/HT213532	af854a3a-2127-422b-91ae-364da2661108	Release Notes Vendor Advisory
https://support.apple.com/en-us/HT213535	af854a3a-2127-422b-91ae-364da2661108	Release Notes Vendor Advisory
https://support.apple.com/en-us/HT213537	af854a3a-2127-422b-91ae-364da2661108	Release Notes Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-42856	134c704f-9b21-4f2e-91b3-4a467353bcc0	US Government Resource

Hyperlink: http://seclists.org/fulldisclosure/2022/Dec/21

Source: product-security@apple.com

Resource:

Mailing List

Third Party Advisory

Hyperlink: http://seclists.org/fulldisclosure/2022/Dec/22

Source: product-security@apple.com

Resource:

Mailing List

Third Party Advisory

Hyperlink: http://seclists.org/fulldisclosure/2022/Dec/23

Source: product-security@apple.com

Resource:

Mailing List

Third Party Advisory

Hyperlink: http://seclists.org/fulldisclosure/2022/Dec/26

Source: product-security@apple.com

Resource:

Mailing List

Third Party Advisory

Hyperlink: http://seclists.org/fulldisclosure/2022/Dec/28

Source: product-security@apple.com

Resource:

Mailing List

Third Party Advisory

Hyperlink: http://www.openwall.com/lists/oss-security/2022/12/26/1

Source: product-security@apple.com

Resource:

Mailing List

Third Party Advisory

Hyperlink: https://security.gentoo.org/glsa/202305-32

Source: product-security@apple.com

Resource:

Third Party Advisory

Hyperlink: https://support.apple.com/en-us/HT213516

Source: product-security@apple.com

Resource:

Release Notes

Vendor Advisory

Hyperlink: https://support.apple.com/en-us/HT213531

Source: product-security@apple.com

Resource:

Release Notes

Vendor Advisory

Hyperlink: https://support.apple.com/en-us/HT213532

Source: product-security@apple.com

Resource:

Release Notes

Vendor Advisory

Hyperlink: https://support.apple.com/en-us/HT213535

Source: product-security@apple.com

Resource:

Release Notes

Vendor Advisory

Hyperlink: https://support.apple.com/en-us/HT213537

Source: product-security@apple.com

Resource:

Release Notes

Vendor Advisory

Hyperlink: http://seclists.org/fulldisclosure/2022/Dec/21

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Mailing List

Third Party Advisory

Hyperlink: http://seclists.org/fulldisclosure/2022/Dec/22

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Mailing List

Third Party Advisory

Hyperlink: http://seclists.org/fulldisclosure/2022/Dec/23

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Mailing List

Third Party Advisory

Hyperlink: http://seclists.org/fulldisclosure/2022/Dec/26

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Mailing List

Third Party Advisory

Hyperlink: http://seclists.org/fulldisclosure/2022/Dec/28

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Mailing List

Third Party Advisory

Hyperlink: http://www.openwall.com/lists/oss-security/2022/12/26/1

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Mailing List

Third Party Advisory

Hyperlink: https://security.gentoo.org/glsa/202305-32

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Third Party Advisory

Hyperlink: https://support.apple.com/en-us/HT213516

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Release Notes

Vendor Advisory

Hyperlink: https://support.apple.com/en-us/HT213531

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Release Notes

Vendor Advisory

Hyperlink: https://support.apple.com/en-us/HT213532

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Release Notes

Vendor Advisory

Hyperlink: https://support.apple.com/en-us/HT213535

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Release Notes

Vendor Advisory

Hyperlink: https://support.apple.com/en-us/HT213537

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Release Notes

Vendor Advisory

Hyperlink: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-42856

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Resource:

US Government Resource

Similar CVEs

1298Records found

CVE-2026-9983

Matching Score-10

Assigner-Chrome

Matching Score-10

Assigner-Chrome

CVSS Score-8.8||HIGH

EPSS-0.26% / 16.80%

7 Day CHG~0.00%

Published-28 May, 2026 | 22:25

Updated-30 May, 2026 | 03:56

Type Confusion in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

Vendor-Microsoft Corporation Linux Kernel Organization, Inc Apple Inc.Google LLC

CWE ID-CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')

CVE-2026-7337

Matching Score-10

Assigner-Chrome

Matching Score-10

Assigner-Chrome

CVSS Score-8.8||HIGH

EPSS-0.34% / 26.40%

7 Day CHG~0.00%

Published-28 Apr, 2026 | 22:36

Updated-01 May, 2026 | 03:55

Type Confusion in V8 in Google Chrome prior to 147.0.7727.138 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

Vendor-Apple Inc.Microsoft Corporation Google LLC Linux Kernel Organization, Inc

CWE ID-CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')

CVE-2026-7927

Matching Score-10

Assigner-Chrome

Matching Score-10

Assigner-Chrome

CVSS Score-8.8||HIGH

EPSS-0.29% / 20.90%

7 Day CHG~0.00%

Published-06 May, 2026 | 18:12

Updated-07 May, 2026 | 03:56

Type Confusion in Runtime in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

Vendor-Apple Inc.Microsoft Corporation Google LLC Linux Kernel Organization, Inc

CWE ID-CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')

CVE-2026-7988

Matching Score-10

Assigner-Chrome

Matching Score-10

Assigner-Chrome

CVSS Score-8.8||HIGH

EPSS-0.31% / 22.48%

7 Day CHG~0.00%

Published-06 May, 2026 | 18:13

Updated-07 May, 2026 | 03:55

Type Confusion in WebRTC in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)

Vendor-Apple Inc.Microsoft Corporation Google LLC Linux Kernel Organization, Inc

CWE ID-CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')

CVE-2026-6301

Matching Score-10

Assigner-Chrome

Matching Score-10

Assigner-Chrome

CVSS Score-8.8||HIGH

EPSS-0.37% / 29.21%

7 Day CHG~0.00%

Published-15 Apr, 2026 | 19:04

Updated-26 May, 2026 | 19:16

Type Confusion in Turbofan in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

Vendor-Microsoft Corporation Linux Kernel Organization, Inc Google LLC Apple Inc.

CWE ID-CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')

CVE-2026-6307

Matching Score-10

Assigner-Chrome

Matching Score-10

Assigner-Chrome

CVSS Score-8.8||HIGH

EPSS-0.36% / 28.47%

7 Day CHG~0.00%

Published-15 Apr, 2026 | 19:04

Updated-17 Apr, 2026 | 17:27

Type Confusion in Turbofan in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

Vendor-Apple Inc.Microsoft Corporation Google LLC Linux Kernel Organization, Inc

Product-linux_kernel chrome windows macos Chrome

CWE ID-CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')

CVE-2026-5865

Matching Score-10

Assigner-Chrome

Matching Score-10

Assigner-Chrome

CVSS Score-8.8||HIGH

EPSS-0.42% / 34.02%

7 Day CHG~0.00%

Published-08 Apr, 2026 | 21:20

Updated-26 May, 2026 | 19:16

Type Confusion in V8 in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

Vendor-Microsoft Corporation Linux Kernel Organization, Inc Google LLC Apple Inc.

CWE ID-CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')

CVE-2026-5871

Matching Score-10

Assigner-Chrome

Matching Score-10

Assigner-Chrome

CVSS Score-8.8||HIGH

EPSS-0.33% / 24.91%

7 Day CHG~0.00%

Published-08 Apr, 2026 | 21:20

Updated-13 Apr, 2026 | 16:18

Type Confusion in V8 in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

Vendor-Apple Inc.Microsoft Corporation Google LLC Linux Kernel Organization, Inc

Product-linux_kernel chrome windows macos Chrome

CWE ID-CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')

CVE-2026-5914

Matching Score-10

Assigner-Chrome

Matching Score-10

Assigner-Chrome

CVSS Score-8.8||HIGH

EPSS-0.16% / 5.95%

7 Day CHG~0.00%

Published-08 Apr, 2026 | 21:21

Updated-29 Apr, 2026 | 16:16

Type Confusion in CSS in Google Chrome prior to 147.0.7727.55 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension. (Chromium security severity: Low)

Vendor-Apple Inc.Google LLC Linux Kernel Organization, Inc Microsoft Corporation

CWE ID-CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')

CVE-2022-42823

Matching Score-10

Assigner-Apple Inc.

Matching Score-10

Assigner-Apple Inc.

CVSS Score-8.8||HIGH

EPSS-1.41% / 69.39%

7 Day CHG~0.00%

Published-01 Nov, 2022 | 00:00

Updated-21 Apr, 2025 | 16:15

A type confusion issue was addressed with improved memory handling. This issue is fixed in tvOS 16.1, macOS Ventura 13, watchOS 9.1, Safari 16.1, iOS 16.1 and iPadOS 16. Processing maliciously crafted web content may lead to arbitrary code execution.

Vendor-Debian GNU/Linux Fedora Project Apple Inc.

Product-ipados tvos fedora debian_linux safari watchos macos iphone_os macOS watchOS tvOS

CWE ID-CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')

CVE-2025-13226

Matching Score-10

Assigner-Chrome

Matching Score-10

Assigner-Chrome

CVSS Score-8.8||HIGH

EPSS-0.22% / 12.39%

7 Day CHG~0.00%

Published-17 Nov, 2025 | 23:19

Updated-26 Feb, 2026 | 16:56

Type Confusion in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Vendor-Apple Inc.Linux Kernel Organization, Inc Google LLC Microsoft Corporation

CWE ID-CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')

CVE-2025-13228

Matching Score-10

Assigner-Chrome

Matching Score-10

Assigner-Chrome

CVSS Score-8.8||HIGH

EPSS-0.22% / 12.39%

7 Day CHG~0.00%

Published-17 Nov, 2025 | 23:19

Updated-26 Feb, 2026 | 16:56

Type Confusion in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Vendor-Apple Inc.Linux Kernel Organization, Inc Google LLC Microsoft Corporation

CWE ID-CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')

CVE-2025-13229

Matching Score-10

Assigner-Chrome

Matching Score-10

Assigner-Chrome

CVSS Score-8.8||HIGH

EPSS-0.22% / 12.39%

7 Day CHG~0.00%

Published-17 Nov, 2025 | 23:19

Updated-26 Feb, 2026 | 16:56

Type Confusion in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Vendor-Apple Inc.Linux Kernel Organization, Inc Google LLC Microsoft Corporation

CWE ID-CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')

CVE-2025-13230

Matching Score-10

Assigner-Chrome

Matching Score-10

Assigner-Chrome

CVSS Score-8.8||HIGH

EPSS-0.22% / 12.39%

7 Day CHG~0.00%

Published-17 Nov, 2025 | 23:19

Updated-26 Feb, 2026 | 16:56

Type Confusion in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Vendor-Apple Inc.Linux Kernel Organization, Inc Google LLC Microsoft Corporation

CWE ID-CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')

CVE-2025-13227

Matching Score-10

Assigner-Chrome

Matching Score-10

Assigner-Chrome

CVSS Score-8.8||HIGH

EPSS-0.22% / 12.39%

7 Day CHG~0.00%

Published-17 Nov, 2025 | 23:19

Updated-26 Feb, 2026 | 16:56

Type Confusion in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Vendor-Apple Inc.Linux Kernel Organization, Inc Google LLC Microsoft Corporation

CWE ID-CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')

CVE-2025-13223

Matching Score-10

Assigner-Chrome

Matching Score-10

Assigner-Chrome

CVSS Score-8.8||HIGH

EPSS-4.83% / 90.92%

7 Day CHG~0.00%

Published-17 Nov, 2025 | 23:03

Updated-26 Feb, 2026 | 16:56

Known KEV||Action Due Date - 2025-12-10||Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Type Confusion in V8 in Google Chrome prior to 142.0.7444.175 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Vendor-Microsoft Corporation Apple Inc.Linux Kernel Organization, Inc Google LLC

Product-macos linux_kernel windows chrome Chrome Chromium V8

CWE ID-CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')

CVE-2025-13224

Matching Score-10

Assigner-Chrome

Matching Score-10

Assigner-Chrome

CVSS Score-8.8||HIGH

EPSS-0.44% / 35.50%

7 Day CHG~0.00%

Published-17 Nov, 2025 | 23:03

Updated-26 Feb, 2026 | 16:56

Type Confusion in V8 in Google Chrome prior to 142.0.7444.175 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Vendor-Apple Inc.Linux Kernel Organization, Inc Google LLC Microsoft Corporation

CWE ID-CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')

CVE-2025-13630

Matching Score-10

Assigner-Chrome

Matching Score-10

Assigner-Chrome

CVSS Score-8.8||HIGH

EPSS-0.39% / 30.60%

7 Day CHG+0.01%

Published-02 Dec, 2025 | 19:00

Updated-26 Feb, 2026 | 16:57

Type Confusion in V8 in Google Chrome prior to 143.0.7499.41 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Vendor-Apple Inc.Linux Kernel Organization, Inc Google LLC Microsoft Corporation

Product-macos linux_kernel windows chrome Chrome

CWE ID-CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')

CVE-2025-12428

Matching Score-10

Assigner-Chrome

Matching Score-10

Assigner-Chrome

CVSS Score-8.8||HIGH

EPSS-6.81% / 93.22%

7 Day CHG~0.00%

Published-10 Nov, 2025 | 20:00

Updated-26 Feb, 2026 | 17:47

Type Confusion in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: High)

Vendor-Apple Inc.Linux Kernel Organization, Inc Google LLC Microsoft Corporation

Product-chrome windows macos linux_kernel Chrome

CWE ID-CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')

CVE-2025-10585

Matching Score-10

Assigner-Chrome

Matching Score-10

Assigner-Chrome

CVSS Score-8.8||HIGH

EPSS-5.42% / 91.72%

7 Day CHG~0.00%

Published-24 Sep, 2025 | 16:17

Updated-26 Feb, 2026 | 17:48

Known KEV||Action Due Date - 2025-10-14||Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Type confusion in V8 in Google Chrome prior to 140.0.7339.185 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Vendor-Microsoft Corporation Apple Inc.Linux Kernel Organization, Inc Google LLC

Product-macos linux_kernel windows chrome Chrome Chromium V8

CWE ID-CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')

CVE-2024-54505

Matching Score-10

Assigner-Apple Inc.

Matching Score-10

Assigner-Apple Inc.

CVSS Score-6.5||MEDIUM

EPSS-1.06% / 60.29%

7 Day CHG~0.00%

Published-11 Dec, 2024 | 22:58

Updated-02 Apr, 2026 | 19:18

A type confusion issue was addressed with improved memory handling. This issue is fixed in Safari 18.2, iOS 18.2 and iPadOS 18.2, iPadOS 17.7.3, macOS Sequoia 15.2, tvOS 18.2, visionOS 2.2, watchOS 11.2. Processing maliciously crafted web content may lead to memory corruption.

Vendor-Apple Inc.

Product-tvos visionos watchos safari macos iphone_os ipados Safari visionOS macOS tvOS iOS and iPadOS iPadOS watchOS

CWE ID-CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')

CVE-2011-0611

Matching Score-10

Matching Score-10

CVSS Score-8.8||HIGH

EPSS-99.41% / 99.94%

7 Day CHG~0.00%

Published-13 Apr, 2011 | 14:00

Updated-21 Apr, 2026 | 20:30

Known KEV||Action Due Date - 2022-03-24||The impacted product is end-of-life and should be disconnected if still in use.

Adobe Flash Player before 10.2.154.27 on Windows, Mac OS X, Linux, and Solaris and 10.2.156.12 and earlier on Android; Adobe AIR before 2.6.19140; and Authplay.dll (aka AuthPlayLib.bundle) in Adobe Reader 9.x before 9.4.4 and 10.x through 10.0.1 on Windows, Adobe Reader 9.x before 9.4.4 and 10.x before 10.0.3 on Mac OS X, and Adobe Acrobat 9.x before 9.4.4 and 10.x before 10.0.3 on Windows and Mac OS X allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted Flash content; as demonstrated by a Microsoft Office document with an embedded .swf file that has a size inconsistency in a "group of included constants," object type confusion, ActionScript that adds custom functions to prototypes, and Date objects; and as exploited in the wild in April 2011.

Vendor-n/a Oracle Corporation Apple Inc.Google LLC openSUSE Microsoft Corporation Adobe Inc.SUSE Linux Kernel Organization, Inc

Product-acrobat acrobat_reader adobe_air mac_os_x linux_enterprise_desktop solaris windows flash_player chrome android linux_kernel chrome_os opensuse n/a reader flash_player air acrobat Flash Player

CWE ID-CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')

CVE-2026-1862

Matching Score-10

Assigner-Chrome

Matching Score-10

Assigner-Chrome

CVSS Score-8.8||HIGH

EPSS-0.58% / 43.44%

7 Day CHG~0.00%

Published-03 Feb, 2026 | 20:56

Updated-26 Feb, 2026 | 15:04

Type Confusion in V8 in Google Chrome prior to 144.0.7559.132 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Vendor-Apple Inc.Linux Kernel Organization, Inc Google LLC Microsoft Corporation

Product-chrome linux_kernel macos windows Chrome

CWE ID-CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')

CVE-2021-30818

Matching Score-10

Assigner-Apple Inc.

Matching Score-10

Assigner-Apple Inc.

CVSS Score-8.8||HIGH

EPSS-1.52% / 71.47%

7 Day CHG~0.00%

Published-28 Oct, 2021 | 18:17

Updated-03 Aug, 2024 | 22:48

A type confusion issue was addressed with improved state handling. This issue is fixed in iOS 14.8 and iPadOS 14.8, tvOS 15, iOS 15 and iPadOS 15, Safari 15, watchOS 8. Processing maliciously crafted web content may lead to arbitrary code execution.

Vendor-Apple Inc.

Product-iphone_os watchos ipados tvos safari macos tvOS Safari watchOS iOS and iPadOS

CWE ID-CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')

CVE-2026-10910

Matching Score-10

Assigner-Android (associated with Google Inc. or Open Handset Alliance)

Matching Score-10

Assigner-Android (associated with Google Inc. or Open Handset Alliance)

CVSS Score-8.8||HIGH

EPSS-0.43% / 34.19%

7 Day CHG~0.00%

Published-04 Jun, 2026 | 23:03

Updated-05 Jun, 2026 | 20:11

Type Confusion in V8 in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

Vendor-Microsoft Corporation Linux Kernel Organization, Inc Apple Inc.Google LLC

CWE ID-CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')

CVE-2024-25575

Matching Score-10

Assigner-Talos

Matching Score-10

Assigner-Talos

CVSS Score-8.8||HIGH

EPSS-17.72% / 96.79%

7 Day CHG~0.00%

Published-30 Apr, 2024 | 14:38

Updated-16 Dec, 2025 | 18:13

A type confusion vulnerability vulnerability exists in the way Foxit Reader 2024.1.0.23997 handles a Lock object. A specially crafted Javascript code inside a malicious PDF document can trigger this vulnerability, which can lead to memory corruption and result in arbitrary code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially crafted, malicious site if the browser plugin extension is enabled.

Vendor-Microsoft Corporation Apple Inc.Foxit Software Incorporated

Product-macos pdf_editor windows pdf_reader Foxit Reader foxit_reader

CWE ID-CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')

CVE-2024-23222

Matching Score-10

Assigner-Apple Inc.

Matching Score-10

Assigner-Apple Inc.

CVSS Score-8.8||HIGH

EPSS-10.59% / 95.23%

7 Day CHG~0.00%

Published-23 Jan, 2024 | 00:25

Updated-03 Apr, 2026 | 11:42

Known KEV||Action Due Date - 2024-02-13||Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

A type confusion issue was addressed with improved checks. This issue is fixed in Safari 17.3, iOS 15.8.7 and iPadOS 15.8.7, iOS 16.7.5 and iPadOS 16.7.5, iOS 17.3 and iPadOS 17.3, macOS Monterey 12.7.3, macOS Sonoma 14.3, macOS Ventura 13.6.4, tvOS 17.3, visionOS 1.0.2. Processing maliciously crafted web content may lead to arbitrary code execution. This fix associated with the Coruna exploit was shipped in iOS 17.3 on January 22, 2024. This update brings that fix to devices that cannot update to the latest iOS version.

Vendor-Apple Inc.

Product-tvos visionos safari macos iphone_os ipados Safari visionOS macOS tvOS iOS and iPadOS Multiple Products

CWE ID-CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')

CVE-2024-11395

Matching Score-10

Assigner-Chrome

Matching Score-10

Assigner-Chrome

CVSS Score-8.8||HIGH

EPSS-0.36% / 27.51%

7 Day CHG~0.00%

Published-19 Nov, 2024 | 19:11

Updated-29 Jul, 2025 | 18:53

Type Confusion in V8 in Google Chrome prior to 131.0.6778.85 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Vendor-Microsoft Corporation Linux Kernel Organization, Inc Apple Inc.Google LLC

Product-windows macos linux_kernel chrome Chrome chrome

CWE ID-CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')

CVE-2018-4920

Matching Score-10

Matching Score-10

Product-linux_kernel windows_8.1 chrome_os mac_os_x windows flash_player_desktop_runtime windows_10 flash_player Adobe Flash Player 28.0.0.161 and earlier versions

CVSS Score-8.8||HIGH

EPSS-7.87% / 93.98%

7 Day CHG~0.00%

Published-19 May, 2018 | 17:00

Updated-05 Aug, 2024 | 05:18

Adobe Flash Player versions 28.0.0.161 and earlier have an exploitable type confusion vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.

Vendor-n/a Google LLC Adobe Inc.Apple Inc.Microsoft Corporation Linux Kernel Organization, Inc

CWE ID-CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')

CVE-2026-4457

Matching Score-10

Assigner-Android (associated with Google Inc. or Open Handset Alliance)

Matching Score-10

Assigner-Android (associated with Google Inc. or Open Handset Alliance)

CVSS Score-8.8||HIGH

EPSS-0.31% / 22.36%

7 Day CHG~0.00%

Published-20 Mar, 2026 | 01:34

Updated-21 Mar, 2026 | 04:01

Type Confusion in V8 in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Vendor-Apple Inc.Microsoft Corporation Google LLC Linux Kernel Organization, Inc

Product-linux_kernel chrome windows macos Chrome

CWE ID-CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')

CVE-2026-43705

Matching Score-10

Assigner-Apple Inc.

Matching Score-10

Assigner-Apple Inc.

CVSS Score-8.8||HIGH

EPSS-0.27% / 19.23%

7 Day CHG~0.00%

Published-29 Jun, 2026 | 19:42

Updated-30 Jun, 2026 | 18:26

A type confusion issue was addressed with improved checks. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2. Processing maliciously crafted web content may lead to memory corruption.

Vendor-Apple Inc.

Product-safari macos ipados iphone_os Safari macOS iOS and iPadOS

CWE ID-CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')

CVE-2023-32358

Matching Score-10

Assigner-Apple Inc.

Matching Score-10

Assigner-Apple Inc.

CVSS Score-8.8||HIGH

EPSS-0.59% / 43.89%

7 Day CHG~0.00%

Published-14 Aug, 2023 | 22:40

Updated-09 Oct, 2024 | 14:08

A type confusion issue was addressed with improved checks. This issue is fixed in iOS 16.4 and iPadOS 16.4, macOS Ventura 13.3. Processing web content may lead to arbitrary code execution.

Vendor-Apple Inc.

Product-iphone_os macos ipados macOS iOS and iPadOS

CWE ID-CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')

CVE-2023-32439

Matching Score-10

Assigner-Apple Inc.

Matching Score-10

Assigner-Apple Inc.

CVSS Score-8.8||HIGH

EPSS-23.79% / 97.54%

7 Day CHG~0.00%

Published-23 Jun, 2023 | 00:00

Updated-23 Oct, 2025 | 18:47

Known KEV||Action Due Date - 2023-07-14||Apply updates per vendor instructions.

A type confusion issue was addressed with improved checks. This issue is fixed in iOS 16.5.1 and iPadOS 16.5.1, iOS 15.7.7 and iPadOS 15.7.7, macOS Ventura 13.4.1, Safari 16.5.1. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.

Vendor-webkitgtk Apple Inc.

Product-ipados webkitgtk\+macos safari iphone_os Safari iOS and iPadOS macOS Multiple Products

CWE ID-CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')

CVE-2023-3079

Matching Score-10

Assigner-Chrome

Vendor-Couchbase, Inc.Apple Inc.Google LLC Debian GNU/Linux Microsoft Corporation Fedora Project Linux Kernel Organization, Inc

Matching Score-10

Assigner-Chrome

CVSS Score-8.8||HIGH

EPSS-32.72% / 98.14%

7 Day CHG~0.00%

Published-05 Jun, 2023 | 21:40

Updated-24 Oct, 2025 | 14:07

Known KEV||Action Due Date - 2023-06-28||Apply updates per vendor instructions.

Type confusion in V8 in Google Chrome prior to 114.0.5735.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Product-couchbase_server debian_linux windows fedora linux_kernel macos chrome Chrome Chromium V8

CWE ID-CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')

CVE-2017-5070

Matching Score-10

Assigner-Chrome

Product-enterprise_linux_server enterprise_linux_workstation enterprise_linux_desktop windows macos chrome android linux_kernel Google Chrome prior to 59.0.3071.86 for Linux, Windows and Mac, and 59.0.3071.92 for Android Chromium V8

Matching Score-10

Assigner-Chrome

CVSS Score-8.8||HIGH

EPSS-31.21% / 98.05%

7 Day CHG~0.00%

Published-27 Oct, 2017 | 05:00

Updated-21 Apr, 2026 | 17:51

Known KEV||Action Due Date - 2022-06-22||Apply updates per vendor instructions.

Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.

Vendor-n/a Microsoft Corporation Red Hat, Inc.Apple Inc.Linux Kernel Organization, Inc Google LLC

CWE ID-CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')

CVE-2021-30852

Matching Score-10

Assigner-Apple Inc.

Matching Score-10

Assigner-Apple Inc.

CVSS Score-8.8||HIGH

EPSS-1.41% / 69.32%

7 Day CHG~0.00%

Published-24 Aug, 2021 | 18:49

Updated-03 Aug, 2024 | 22:48

A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 14.8 and iPadOS 14.8, tvOS 15, watchOS 8, iOS 15 and iPadOS 15. Processing maliciously crafted web content may lead to arbitrary code execution.

Vendor-Apple Inc.

Product-iphone_os watchos tvos ipados macos tvOS watchOS iOS and iPadOS

CWE ID-CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')

CVE-2017-11292

Matching Score-10

Matching Score-10

Vendor-n/a Microsoft Corporation Red Hat, Inc.Adobe Inc.Apple Inc.Linux Kernel Organization, Inc Google LLC

CVSS Score-8.8||HIGH

EPSS-12.10% / 95.64%

7 Day CHG~0.00%

Published-21 Oct, 2017 | 05:00

Updated-22 Apr, 2026 | 12:14

Known KEV||Action Due Date - 2022-03-24||The impacted product is end-of-life and should be disconnected if still in use.

Adobe Flash Player version 27.0.0.159 and earlier has a flawed bytecode verification procedure, which allows for an untrusted value to be used in the calculation of an array index. This can lead to type confusion, and successful exploitation could lead to arbitrary code execution.

Product-windows_10 mac_os_x windows_8.1 enterprise_linux_server enterprise_linux_workstation enterprise_linux_desktop windows flash_player linux_kernel flash_player_desktop_runtime chrome_os Adobe Flash Player version 27.0.0.159 and earlier Flash Player

CWE ID-CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')

CVE-2023-23529

Matching Score-10

Assigner-Apple Inc.

Matching Score-10

Assigner-Apple Inc.

CVSS Score-8.8||HIGH

EPSS-9.50% / 94.85%

7 Day CHG~0.00%

Published-27 Feb, 2023 | 00:00

Updated-23 Oct, 2025 | 18:04

Known KEV||Action Due Date - 2023-03-07||Apply updates per vendor instructions.

A type confusion issue was addressed with improved checks. This issue is fixed in iOS 15.7.4 and iPadOS 15.7.4, iOS 16.3.1 and iPadOS 16.3.1, macOS Ventura 13.2.1, Safari 16.3. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.

Vendor-Apple Inc.

Product-ipados safari iphone_os macos Safari iOS and iPadOS macOS Multiple Products

CWE ID-CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')

CVE-2016-6992

Matching Score-10

Matching Score-10

CVSS Score-8.8||HIGH

EPSS-6.25% / 92.70%

7 Day CHG~0.00%

Published-13 Oct, 2016 | 19:00

Updated-06 May, 2026 | 22:30

Adobe Flash Player before 18.0.0.382 and 19.x through 23.x before 23.0.0.185 on Windows and OS X and before 11.2.202.637 on Linux allows attackers to execute arbitrary code by leveraging an unspecified "type confusion."

Vendor-n/a Apple Inc.Google LLC Linux Kernel Organization, Inc Microsoft Corporation Adobe Inc.

Product-windows_10 mac_os_x windows_8.1 windows flash_player linux_kernel flash_player_desktop_runtime chrome_os n/a

CWE ID-CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')

CVE-2026-11662

Matching Score-10

Assigner-Chrome

Matching Score-10

Assigner-Chrome

CVSS Score-8.8||HIGH

EPSS-0.36% / 27.95%

7 Day CHG~0.00%

Published-08 Jun, 2026 | 23:27

Updated-09 Jun, 2026 | 14:58

Type Confusion in Bindings in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

Vendor-Microsoft Corporation Linux Kernel Organization, Inc Apple Inc.Google LLC

CWE ID-CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')

CVE-2016-4223

Matching Score-10

Matching Score-10

CVSS Score-8.8||HIGH

EPSS-7.39% / 93.67%

7 Day CHG~0.00%

Published-13 Jul, 2016 | 01:00

Updated-06 May, 2026 | 22:30

Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code by leveraging an unspecified "type confusion," a different vulnerability than CVE-2016-4224 and CVE-2016-4225.

Vendor-n/a Apple Inc.Google LLC Linux Kernel Organization, Inc Microsoft Corporation Adobe Inc.

Product-windows_10 mac_os_x windows_8.1 windows flash_player linux_kernel flash_player_desktop_runtime chrome_os n/a

CWE ID-CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')

CVE-2016-4225

Matching Score-10

Matching Score-10

CVSS Score-8.8||HIGH

EPSS-7.39% / 93.67%

7 Day CHG~0.00%

Published-13 Jul, 2016 | 01:00

Updated-06 May, 2026 | 22:30

Vendor-n/a Apple Inc.Google LLC Linux Kernel Organization, Inc Microsoft Corporation Adobe Inc.

Product-windows_10 mac_os_x windows_8.1 windows flash_player linux_kernel flash_player_desktop_runtime chrome_os n/a

CWE ID-CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')

CVE-2016-4224

Matching Score-10

Matching Score-10

CVSS Score-8.8||HIGH

EPSS-7.39% / 93.67%

7 Day CHG~0.00%

Published-13 Jul, 2016 | 01:00

Updated-06 May, 2026 | 22:30

Vendor-n/a Apple Inc.Google LLC Linux Kernel Organization, Inc Microsoft Corporation Adobe Inc.

Product-windows_10 mac_os_x windows_8.1 windows flash_player linux_kernel flash_player_desktop_runtime chrome_os n/a

CWE ID-CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')

CVE-2016-4149

Matching Score-10

Matching Score-10

Product-windows_10 linux_enterprise_desktop mac_os_x windows_8.1 enterprise_linux_server enterprise_linux_workstation linux_enterprise_workstation_extension enterprise_linux_desktop windows flash_player linux_kernel flash_player_desktop_runtime chrome_os opensuse n/a

CVSS Score-8.8||HIGH

EPSS-3.81% / 88.74%

7 Day CHG~0.00%

Published-16 Jun, 2016 | 14:00

Updated-06 May, 2026 | 22:30

Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in MS16-083.

Vendor-n/a Apple Inc.openSUSE Google LLC Linux Kernel Organization, Inc SUSE Red Hat, Inc.Microsoft Corporation Adobe Inc.

CWE ID-CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')

CVE-2026-11076

Matching Score-10

Assigner-Android (associated with Google Inc. or Open Handset Alliance)

Matching Score-10

Assigner-Android (associated with Google Inc. or Open Handset Alliance)

CVSS Score-8.8||HIGH

EPSS-0.31% / 23.04%

7 Day CHG~0.00%

Published-04 Jun, 2026 | 23:04

Updated-06 Jun, 2026 | 03:56

Type Confusion in CSS in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)

Vendor-Microsoft Corporation Linux Kernel Organization, Inc Apple Inc.Google LLC

CWE ID-CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')

CVE-2025-8010

Matching Score-10

Assigner-Chrome

Matching Score-10

Assigner-Chrome

CVSS Score-8.8||HIGH

EPSS-0.25% / 16.20%

7 Day CHG~0.00%

Published-22 Jul, 2025 | 21:11

Updated-26 Feb, 2026 | 17:50

Type Confusion in V8 in Google Chrome prior to 138.0.7204.168 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Vendor-Apple Inc.Linux Kernel Organization, Inc Google LLC Microsoft Corporation

Product-chrome linux_kernel macos windows Chrome

CWE ID-CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')

CVE-2025-8011

Matching Score-10

Assigner-Chrome

Matching Score-10

Assigner-Chrome

CVSS Score-8.8||HIGH

EPSS-0.25% / 16.20%

7 Day CHG~0.00%

Published-22 Jul, 2025 | 21:11

Updated-26 Feb, 2026 | 17:50

Type Confusion in V8 in Google Chrome prior to 138.0.7204.168 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Vendor-Apple Inc.Linux Kernel Organization, Inc Google LLC Microsoft Corporation

Product-chrome linux_kernel macos windows Chrome

CWE ID-CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')

CVE-2016-0985

Matching Score-10

Matching Score-10

CVSS Score-8.8||HIGH

EPSS-27.27% / 97.81%

7 Day CHG~0.00%

Published-10 Feb, 2016 | 20:00

Updated-06 May, 2026 | 22:30

Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0.260, Adobe AIR SDK before 20.0.0.260, and Adobe AIR SDK & Compiler before 20.0.0.260 allow attackers to execute arbitrary code by leveraging an unspecified "type confusion."

Vendor-n/a Apple Inc.Google LLC Linux Kernel Organization, Inc Microsoft Corporation Adobe Inc.

Product-windows_10 mac_os_x windows_8.1 air_sdk_\&_compiler windows flash_player iphone_os air_sdk android air_desktop_runtime linux_kernel flash_player_desktop_runtime chrome_os n/a

CWE ID-CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')

CVE-2016-1015

Matching Score-10

Matching Score-10

CVSS Score-8.8||HIGH

EPSS-7.13% / 93.49%

7 Day CHG~0.00%

Published-09 Apr, 2016 | 01:00

Updated-06 May, 2026 | 22:30

Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allows attackers to execute arbitrary code by overriding NetConnection object properties to leverage an unspecified "type confusion," a different vulnerability than CVE-2016-1019.

Vendor-n/a Apple Inc.Google LLC Linux Kernel Organization, Inc Microsoft Corporation Adobe Inc.

Product-windows_10 mac_os_x windows_8.1 air_sdk_\&_compiler windows flash_player iphone_os air_sdk android air_desktop_runtime linux_kernel flash_player_desktop_runtime chrome_os n/a

CWE ID-CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')

CVE-2021-30758

Matching Score-10

Assigner-Apple Inc.