CISA adds bugs in Chrome and macOS to its Known Exploited Vulnerabilities catalog

CVE-2019-8526 is a use-after-free (CWE-416) memory-corruption flaw in Apple macOS that can be triggered by a low-privileged application already running on the target Mac, with no user interaction required. Successful exploitation lets an attacker gain elevated privileges beyond those of the triggering application, making it a local privilege escalation vector that is typically chained with other flaws. The issue is fixed in macOS Mojave 10.14.4, so users and organizations running earlier macOS builds are affected. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on 2023-04-17, confirming exploitation in the wild, though ransomware use is unknown and no public proof-of-concept is known. Related reporting on macOS watering-hole attacks delivering the DazzleSpy backdoor underscores active macOS targeting, but the provided data does not confirm a direct link to this specific CVE.

Do: Upgrade affected Macs to macOS Mojave 10.14.4 or a later macOS release per Apple's instructions (CISA's required action), and inventory for any machines stuck on older builds using About This Mac or 'sw_vers -productVersion'. Because the flaw requires local execution, prioritize multi-user, shared, or high-risk Macs. Given confirmed in-the-wild exploitation, hunt for signs of post-exploitation on previously unpatched systems, keeping in mind macOS backdoor campaigns (e.g., DazzleSpy) reported against Mac users.

CVE-2023-2033 is a type confusion flaw (CWE-843) in Google's Chromium V8 JavaScript engine that a remote attacker can trigger by convincing a user to load a crafted HTML page. Successful exploitation could lead to heap corruption in the browser, potentially allowing the attacker to execute code in the context of the affected browser. Because V8 underpins the entire Chromium ecosystem, users of Google Chrome, Microsoft Edge, Opera, and any other Chromium-based browser or application are potentially affected. The flaw is already being exploited: CISA added it to the Known Exploited Vulnerabilities catalog on 2023-04-17, and EPSS assigns a 40.8% probability of exploitation within 30 days (99th percentile), though no public proof-of-concept is known and ransomware use is unknown.

Do: Update Google Chrome and every other Chromium-based browser in use (Microsoft Edge, Opera, Brave, etc.) to the latest vendor-supplied stable release, per CISA's KEV required action to apply updates per vendor instructions. Verify installed browser versions across managed endpoints and treat unpatched Chromium builds as actively exploited given the KEV listing and high EPSS score.