New Chrome 0-day Bug Under Active Attacks
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-21148 | Heap Buffer Overflow in Google Chrome/Chromium V8 (CVE-2021-21148) CVE-2021-21148 is a heap buffer overflow (out-of-bounds write, CWE-787) in the V8 JavaScript engine used by Google Chrome and Chromium. A remote attacker triggers it by getting a user to open a crafted HTML page, so user interaction is required, but no privileges or special access are needed. Successful exploitation corrupts the heap and can allow the attacker to run code within the browser, with high impact on confidentiality, integrity, and availability (CVSS 3.1: 8.8). All Chrome/Chromium builds prior to 88.0.4324.150 are affected, including the chromium packages shipped in Fedora and Debian. Google patched the flaw in an emergency update for what headlines described as a Chrome zero-day, and its inclusion in the CISA Known Exploited Vulnerabilities catalog (added 2021-11-03) confirms exploitation in the wild, despite no public PoC; EPSS estimates a 20% probability of exploitation over the next 30 days (97th percentile). Do: Upgrade Google Chrome/Chromium to 88.0.4324.150 or later on all endpoints, and install the updated chromium packages from Fedora and Debian. Verify fleet-wide browser versions, since a single user opening a malicious page is enough for compromise, and confirm auto-update is enabled on managed browsers. | 8.8 | 20% | KEV |
| mass≈3 billion+ users (Chrome's global install base; essentially every Chrome/Chromium build before 88.0.4324.150 was vulnerable) | |
| CVE-2021-21166 | Race Condition Heap Corruption in Google Chromium (Chrome, Edge, Opera) Google Chromium contains a race condition (CWE-362) that can lead to heap corruption (CWE-122) when the browser processes a crafted HTML page, meaning an attacker can trigger the flaw simply by getting a user to visit an attacker-controlled or malicious webpage. Successful exploitation of the heap corruption could crash the browser and potentially allow the attacker to execute code within the affected browser process. Because the vulnerable code is in the Chromium engine itself, all Chromium-based browsers are potentially affected, including Google Chrome, Microsoft Edge, Opera, and other derived browsers, across desktop and mobile fleets. CISA added CVE-2021-21166 to the Known Exploited Vulnerabilities catalog on 2021-11-03, confirming the flaw is being exploited in the wild, though ransomware use is unknown and no public proof-of-concept is available. EPSS currently assigns a 26.7% probability of exploitation within 30 days (98th percentile), and CVSS scoring has not yet been published. Do: Apply the latest patched releases of all Chromium-based browsers in use (Chrome, Edge, Opera, and any derived browsers) per vendor instructions, as required by CISA's KEV listing. Prioritize managed endpoints and any systems where users browse untrusted or internet-facing websites, verify fleet-wide browser versions after updating, and monitor CISA/vendor advisories for ransomware-associated activity since that linkage is currently unknown. | 8.8 | 27% | KEV |
| massbillions of users and installations (Chromium powers Chrome, Edge, Opera and many other browsers) |
Full article324 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananMar 03, 2021
Exactly a month after patching an actively exploited zero-day flaw in Chrome, Google today rolled out fixes for yet another zero-day vulnerability in the world's most popular web browser that it says is being abused in the wild.
Chrome 89.0.4389.72, released by the search giant for Windows, Mac, and Linux on Tuesday, comes with a total of 47 security fixes, the most severe of which concerns an "object lifecycle issue in audio."
Tracked as CVE-2021-21166, the security flaw is one of the two bugs reported last month by Alison Huffman of Microsoft Browser Vulnerability Research on February 11. A separate object lifecycle flaw, also identified in the audio component, was reported to Google on February 4, the same day the stable version of Chrome 88 became available.
With no additional details, it's not immediately clear if the two security shortcomings are related.
Google acknowledged that an exploit for the vulnerability exists in the wild but stopped short of sharing more specifics to allow a majority of users to install the fixes and prevent other threat actors from creating exploits targeting this zero-day.
"Google is aware of reports that an exploit for CVE-2021-21166 exists in the wild," Chrome Technical Program Manager Prudhvikumar Bommana said.
This is the second zero-day flaw in Chrome that Google has addressed since the start of the year.
On February 4, the company issued a fix for an actively-exploited heap buffer overflow flaw (CVE-2021-21148) in its V8 JavaScript rendering engine. Additionally, Google last year resolved five Chrome zero-days that were actively exploited in the wild in a span of one month between October 20 and November 12.
Chrome users can update to the latest version by heading to Settings > Help > About Google Chrome to mitigate the risk associated with the flaw.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2021/03/new-chrome-0-day-bug-under-active.html