0-day In-the-Wild Exploitation in 2022...so far.

Project Zero’s Zero-Day Mission

Google Project Zero researcher Maddie Stone tracks zero-days exploited in the wild to drive structural mitigations and “make zero-day hard”—raising exploit cost and requiring more bugs per capability. She maintains public spreadsheets and a GitHub repository of in-the-wild zero-days since mid-2014.

2022 Statistics So Far

Through 2022 the team counted 18 in-the-wild zero-days. Nine were variants of previously patched bugs; four were variants of 2021 zero-days attackers reused within roughly twelve months because patches were incomplete. Stone argues this shows zero-days are not yet “hard.”

What “Hard” Would Look Like

Remote phone compromise via a link still typically chains about three zero-days (renderer RCE, sandbox escape, local privilege escalation). Harder ecosystems would require more chained bugs, novel bug classes, undocumented attack surfaces, non-reusable exploit techniques, and highly selective deployment rather than broad watering-hole burns.