# CVE-2022-1096: Chrome Type Confusion in Property Access Interceptor

V8 property access interceptor for CSSStyleDeclaration didn't re-check property state after user JS ran, causing double-add and type confusion, exploited as Chrome 0-day for RCE.

- Payout: Real-world hack
- Severity: high
- Program: Google Chromium
- Credited: Anonymous
- Disclosed: 2022-03-25
- CVE: CVE-2022-1096
- Write-up quality: 8/10
- Original: https://github.com/googleprojectzero/0days-in-the-wild/blob/main/0day-RCAs/2022/CVE-2022-1096.md
- Library page: https://bugbountylibrary.com/r/p0%3ACVE-2022-1096
- Tags: domain:browser impact:rce kind:incident platform:project-zero sev:high tech:chromium technique:incomplete-fix technique:source-review vuln:memory-corruption

**Target:** V8 property access interceptor on CSSStyleDeclaration
**Root cause:** SetPropertyInternal's interceptor runs user JS that can add the property, but execution continues assuming it still doesn't exist, adding it a second time and corrupting the object.
**Steps:**
1. Create `style = document.createElement('p').style`
2. Assign `style.prop = { toString: () => { style.prop = 1; } }`
3. Interceptor runs toString during assignment, adding `prop` to the object
4. After JS returns, V8 re-adds `prop` assuming absence, corrupting the object
5. Use corrupted object to build RCE primitive
**How found:** Variant analysis: the CVE-2021-30551 patch only covered the prototype-chain branch of SetPropertyInternal, so the author reasoned the directly-owned-property branch remained vulnerable.
**Exploitation:** Zero-day exploited in the wild; exploit sample not available to author. Likely same flow as CVE-2021-30551: corrupt object to gain arbitrary read/write then RCE in renderer.
**Insight:** When a patch guards only one if/else branch of a state-recheck, test the sibling branch; also check alternate entry points like Object.defineProperty (DefineOwnPropertyIgnoreAttributes) that bypass the patched function.