Google patches a mystery zero-day Chrome vulnerability

A type confusion bug is where you are able trick a program into saving data for one purpose (data type A) but then using it later for a different purpose (data type B).Imagine that a program is very careful about what values it allows you to store into memory when you are treating it as type B.For example, if a 'type B' memory location keeps track of a memory address (a pointer, to use the jargon word), then the program will probably go to great lengths to stop you modifying it however you like.Otherwise, you might end up with the power to read secret data from memory locations you aren't supposed to access, or to execute unknown and untrusted program code such as malware.On the other hand, a memory location that's used to store something such as a color you just chose from a menu might happily accept any value you like, such as 0x00000000 (meaning completely transparent) all the way to 0xFFFFFFFF (meaning bright white and totally opaque).So if you can get the program to let you write to memory under the low-risk assumption that it is storing a color, but later to use that "color" as what it thinks is a trusted memory address in order to transfer program execution into your malware code……you just used type confusion to bypass the security checks that should have been applied to the memory pointer.