Google Chrome Hit by Second Zero-Day Attack

CVE-2023-2033 is a type confusion flaw (CWE-843) in Google's Chromium V8 JavaScript engine that a remote attacker can trigger by convincing a user to load a crafted HTML page. Successful exploitation could lead to heap corruption in the browser, potentially allowing the attacker to execute code in the context of the affected browser. Because V8 underpins the entire Chromium ecosystem, users of Google Chrome, Microsoft Edge, Opera, and any other Chromium-based browser or application are potentially affected. The flaw is already being exploited: CISA added it to the Known Exploited Vulnerabilities catalog on 2023-04-17, and EPSS assigns a 40.8% probability of exploitation within 30 days (99th percentile), though no public proof-of-concept is known and ransomware use is unknown.

Do: Update Google Chrome and every other Chromium-based browser in use (Microsoft Edge, Opera, Brave, etc.) to the latest vendor-supplied stable release, per CISA's KEV required action to apply updates per vendor instructions. Verify installed browser versions across managed endpoints and treat unpatched Chromium builds as actively exploited given the KEV listing and high EPSS score.

An integer overflow (CWE-190) in Skia, the 2D graphics library used by Chrome's renderer, can be triggered by a crafted HTML page whose content drives Skia processing past the limits of its integer math. A remote attacker who has already compromised the Chrome renderer process — for example through a separate renderer flaw or a malicious page — can leverage the overflow to escape Chrome's renderer sandbox and gain broader code execution on the host. All Google Chrome and Chromium users running versions prior to 112.0.5615.137 are affected, including Chromium packages shipped by Debian and Fedora. The flaw is rated Critical (CVSS 3.1: 9.6) and carries Chromium security severity High, with an EPSS probability of 5.7% (93rd percentile) of exploitation within 30 days. It was added to CISA's Known Exploited Vulnerability catalog on 2023-04-21, and news reports describe it as an actively exploited Chrome zero-day for which Google rushed out the 112.0.5615.137 patch.

Do: Update Google Chrome to 112.0.5615.137 or later on all platforms, and install the corresponding Chromium security updates on Debian and Fedora systems. Because exploitation requires user interaction with a crafted page plus a pre-existing renderer compromise, prompt patching is the primary mitigation; verify via CISA KEV required actions that all managed browsers are updated and confirm Chrome versions in endpoint inventory.