Google pushes emergency update for Chrome zero-days, the latest in a hectic year for vulnerabilities

That's a dozen so far this year alone, as zero-days are having a record year everywhere.

Google Chrome has issued emergency updates for two zero-day flaws that attackers are exploiting, the second pair for the browser in a month.

It’s been a record year for such flaws, which previously unknown to the vendor. Chrome itself has caught 12 zero-days to date in 2021 compared to eight in all of 2020, according to Google’s Project Zero “0day in the Wild” database, which tracks zero-days.

By many measurements, Chrome is the world’s most popular browser, with one report putting its user count at nearly 3.3 billion. That makes it a lucrative target for hackers. There doesn’t appear to be just one answer for the rise in zero-days in 2021, even as more people seem to invest in hacking techniques. Defenders are also improving their own detection skills.

“Google is aware the exploits” for the two flaws “exist in the wild,” the company wrote on Thursday.

Google otherwise didn’t provide many details about the flaws. One, deemed high severity, was a kind of memory-corruption bug. Google Threat Analysis Group discovered it. Five of this year’s Chrome zero-days have been of this type, known as “use after free.”

The other zero-day, deemed medium severity, was related to “information leak in core.” An anonymous contributor uncovered that one.

“Access to bug details and links may be kept restricted until a majority of users are updated with a fix,” Google wrote. “We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven’t yet fixed.”

In other recent zero-day news, a researcher who uncovered three such flaws in iOS15 published them and expressed frustration at Apple for allegedly ignoring him. Apple said it was still investigating the zero-days.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

• Dogged Russia-based botnet dismantled after 23-year run

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure