Google Chrome 'SymStealer' Vulnerability Could Affect 2.5 Billion Users
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2022-3656 | Insufficient data validation in File System in Google Chrome prior to 107.0.5304.62 allowed a remote attacker to bypass file system restrictions via a crafted H Insufficient data validation in File System in Google Chrome prior to 107.0.5304.62 allowed a remote attacker to bypass file system restrictions via a crafted HTML page. (Chromium security severity: Medium) NVD description · AI analysis pending | 8.8 | 2% |
| — | ||
| CVE-2022-4135 | Chromium GPU heap buffer overflow enables sandbox escape (affects Chrome, Edge, Opera) CVE-2022-4135 is a heap buffer overflow (CWE-787, out-of-bounds write) in the GPU process of Google Chromium, the browser engine behind Chrome and most other major browsers. It is triggered via a crafted HTML page and, per CISA, requires the attacker to have already compromised the browser's renderer process; the memory corruption in the GPU process can then be leveraged to escape the renderer sandbox. A successful attack moves the attacker out of the tightly restricted renderer sandbox toward the higher-privilege GPU process on the host, a step that can enable further code execution. All users of Chromium-based browsers are affected — CISA explicitly lists Google Chrome, Microsoft Edge, and Opera, among others — though no specific vulnerable version ranges are published in the source data. Exploitation is confirmed in the wild: CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2022-11-28, EPSS assigns a 31.9% probability of exploitation within 30 days (98th percentile), and no public proof-of-concept is known. Do: Treat unpatched Chromium-based browsers as exposed and apply vendor updates immediately, per CISA's required action: update Google Chrome, Microsoft Edge, Opera, and any other Chromium-based browsers to the latest patched releases available as of the late-November 2022 KEV listing. Inventory managed endpoints for browser versions and verify auto-update is enabled, since the flaw is confirmed exploited in the wild even though no public PoC exists. | 9.6 | 32% | KEV PoC |
| mass≈billions of users across Google Chrome, Microsoft Edge, Opera and other Chromium-based browsers (exact count unknown) |
Full article367 words · extracted from infosecurity-magazine.com · click to collapse
The Chromium vulnerability (tracked CVE-2022-3656) discovered by Imperva security researchers in July 2022 and patched in September could still affect 2.5 billion users if they don't update their browsers.
The warning comes from Imperva's security researcher Ron Masas, who published a blog post about the flaw (commonly known as “SymStealer") on Wednesday.
In particular, the vulnerability allows for the theft of sensitive files, including crypto wallets and cloud provider credentials, by exploiting how browsers process symbolic links (symlinks).
"[Symlinks] can be useful for creating shortcuts, redirecting file paths, or organizing files in a more flexible way," Masas wrote.
"However, [they] can also introduce vulnerabilities if they are not handled properly. In the case of the vulnerability we disclosed to Google, the issue arose from the way the browser interacted with symlinks when processing files and directories."
In other words, due to the flaw, the browser did not correctly check if the symlink was directing users to a location that was not meant to be accessible, which, in turn, enabled the theft of sensitive files.
"This issue is commonly known as symbolic link following," explained Masas, who added the bug could be used by an attacker, for instance, to create a fake website that offers a new crypto wallet service.
After discovering the vulnerability, Imperva created a proof-of-concept on the Chromium bug tracker, showcasing how a related attack could occur in the wild.
"After disclosing the vulnerability to Google, the Imperva team found that the first fix, introduced in Chrome 107, did not fully address the issue," Masas revealed.
"The team notified Google of this, and the issue was fully resolved in Chrome 108. It is important to always keep your software up to date in order to protect against the latest vulnerabilities and ensure that your personal and financial information remains secure."
SymStealer is only the latest Chrome vulnerability discovered in recent months. In September 2022, developer Jeff Johnson found a flaw that would allow web pages to replace the content of the system clipboard without the user's consent or interaction.
More recently, Google patched a zero-day vulnerability (tracked CVE-2022-4135) that could potentially enable attackers to corrupt data and remotely execute code on a victim's machine.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/chrome-symstealer-flaw-could/