Google fixes Chrome zero
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2019-13720 | Use-After-Free in Google Chrome WebAudio Allows Heap Corruption (Actively Exploited) CVE-2019-13720 is a use-after-free (CWE-416) in the WebAudio component of Google Chrome that exists in all releases prior to 78.0.3904.87. A remote attacker can trigger the flaw by luring a user to a crafted HTML page, corrupting the heap when the browser processes audio through the freed memory. Successful exploitation can lead to remote code execution with high impact on confidentiality, integrity, and availability, and a public proof-of-concept for Chrome 78.0.3904.70 is available. The flaw affects desktop and mobile users running vulnerable Chrome builds as well as the Chromium package shipped for openSUSE Leap. Exploitation is confirmed in the wild: Google fixed it as an actively exploited issue in November 2019, it was used in the Operation WizardOpium attacks, and it was added to CISA's Known Exploited Vulnerabilities catalog on 2022-05-23. Do: Upgrade Google Chrome to 78.0.3904.87 or later (check the current version via the browser's About/Help page) and update the Chromium package on openSUSE Leap using the distribution's update channels. Because this flaw is triggered via a crafted web page and there are no reliable configuration workarounds, prioritizing browser patching across all endpoints is the key mitigation. Defenders should also review whether any user activity coincided with the Operation WizardOpium campaign, as this bug was chained in active attacks. | 8.8 | 73% | KEV PoC |
| masshundreds of millions to billions of Chrome installations worldwide (Chrome is the dominant web browser) | |
| CVE-2019-5786 | Actively Exploited Use-After-Free in Google Chrome Blink CVE-2019-5786 is a use-after-free (object lifetime) flaw in Blink, the rendering engine of Google Chrome, fixed in Chrome 72.0.3626.121. A remote attacker triggers it by luring a user to a crafted HTML page, where the stale object allows an out-of-bounds memory access within the renderer process. Successful exploitation produces memory corruption in the browser renderer — scored in the CVSS vector primarily as high availability impact — and Google disclosed the flaw being actively exploited in targeted attacks, reportedly chained with a separate Windows zero-day that Microsoft patched out of band in March 2019. Anyone running Chrome older than 72.0.3626.121 was affected, which at disclosure time meant a large share of Chrome's billion-plus desktop user base. Exploitation is confirmed in the wild: the issue was a zero-day before the patch, it was added to CISA's Known Exploited Vulnerabilities catalog on 2022-05-23, and EPSS assigns a ~61.5% probability of exploitation within 30 days (99th percentile). Do: Update Chrome to 72.0.3626.121 or later — verify via the browser's About/Settings help page and relaunch any pending auto-update, since Chrome self-updates but requires a relaunch. Treat as a KEV priority and patch per vendor instructions, and apply Microsoft's March 2019 updates, including the out-of-band Windows fix, because the Chrome flaw was used in combination with a Windows zero-day in the observed targeted attacks. | 6.5 | 62% | KEV PoC |
| mass≈1 billion+ Chrome users/installations at the time (all Chrome deployments on versions before 72.0.3626.121) | |
| CVE-2020-6418 | Type Confusion in Google Chrome's V8 Engine Enables Heap Corruption CVE-2020-6418 is a type confusion vulnerability (CWE-843) in V8, the JavaScript engine used in Google Chrome and Chromium, affecting versions prior to 80.0.3987.122. A remote attacker triggers it by persuading a user to open a crafted HTML page whose JavaScript causes V8 to mishandle object types (public PoCs reference a JSCreate side-effect issue), potentially leading to heap corruption. Successful exploitation can yield arbitrary code execution in the browser, a common stepping stone for further compromise on the victim's system. Any Chrome/Chromium deployment with the vulnerable V8 was affected, including Chromium packages shipped by Fedora, Red Hat Enterprise Linux, and Debian. The flaw was a zero-day exploited in the wild when patched in February 2020; it is listed in CISA KEV (added 2021-11-03) and carries a very high EPSS of 78.8%, making it a priority patch. Do: Update Google Chrome to 80.0.3987.122 or later and confirm the running version via chrome://settings/help or chrome://version. Apply the updated Chromium packages from Fedora, Red Hat, and Debian on managed Linux endpoints and check whether any hosts still run pre-fix Chromium. Given the KEV listing and 78.8% EPSS, treat patching as urgent; as an interim mitigation on unpatched systems, limit untrusted web browsing or restrict JavaScript from untrusted sites. | 8.8 | 79% | KEV PoC ×2 |
| massbillions of users/installations (Chrome's global install base runs to billions, and at disclosure in February 2020 every Chrome user on a pre-80.0.3987.122… |
Full article319 words · extracted from securityaffairs.com · click to collapse
Pierluigi Paganini
February 25, 2020
Google has released Chrome 80 update that addresses three high-severity vulnerabilities, one of them has been exploited in the wild.
Google has released Chrome 80 update (version 80.0.3987.122) that addresses three high-severity vulnerabilities, including a zero-day issue (CVE-2020-6418) that has been exploited in the wild. The CVE-2020-6418 vulnerability is a type confusion issue that affects the V8 open source JavaScript engine used by the Chrome browser.
Google did not disclose details of the attack exploiting this zero-day flaw to avoid other threat actors will start to exploit it. The vulnerability was discovered by Clement Lecigne from the Google Threat Analysis Group.
The remaining flaws fixed by Google are an integer overflow in ICU and an out-of-bounds memory access issue in the streams component.
The integer overflow was reported by the security expert André Bargull, who was awarded $5,000 for its discovery.
The out-of-bounds vulnerability addressed with the release of Chrome 80 update (version 80.0.3987.122) was discovered by Sergei Glazunov of Google Project Zero.
This is the third Chrome zero-day that has been exploited by threat actors in the wild in the past year.
In February 2019, Clement Lecigne discovered a high severity zero-day flaw in Chrome that could be exploited by a remote attacker to execute arbitrary code and take full control of the target computer.
The vulnerability tracked as CVE-2019-5786 resides in the web browsing software and impact all major operating systems including Windows, Apple macOS, and Linux.
In November 2019, Google released security updates to address two high severity vulnerabilities in the Chrome browser, one of which is a zero-day flaw actively exploited in attacks in the wild to hijack computers.
One of the flaw, tracked as CVE-2019-13720, was exploited in a campaign that experts attribute to Korea-linked threat actors.
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – hacking, Google Chrome)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/98440/hacking/google-fixes-chrome-zero-day.html