Update Your Chrome Browser ASAP to Patch a Week Old Public Exploit
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-21206 | Use-After-Free in Google Chrome Blink Engine Exploited in the Wild Google Chrome and Chromium versions prior to 89.0.4389.128 contain a use-after-free flaw (CWE-416) in the Blink rendering engine. A remote attacker can trigger it by luring a user into opening a crafted HTML page, requiring no privileges and only user interaction, which corrupts browser process memory (heap corruption) and can potentially allow arbitrary code execution within the browser. All users of Chrome or Chromium builds older than 89.0.4389.128 are affected, including the Chromium package shipped by Fedora. Google fixed the bug as an actively exploited zero-day in the same release as CVE-2021-21205, and CISA added it to the Known Exploited Vulnerabilities catalog on 2021-11-03; EPSS estimates a 9.3% probability of exploitation within 30 days (95th percentile). Do: Upgrade Google Chrome/Chromium to 89.0.4389.128 or later (verify via chrome://settings/help) and apply Fedora's updated chromium package, then restart the browser so the fix takes effect. Because the flaw is listed in CISA's KEV catalog and was exploited in the wild, prioritize patching for internet-exposed and high-risk users; no public PoC is known, but treat in-the-wild exploitation as confirmed. | 8.8 | 9% | KEV |
| massbillions of users (Chrome's global install base exceeds 3 billion; ~65% desktop browser market share) | |
| CVE-2021-21224 +1 in the same advisory: …21220 | Type Confusion RCE in Google Chrome/Chromium V8 JavaScript Engine CVE-2021-21224 is a type confusion vulnerability (CWE-843) in V8, the JavaScript engine used by Google Chrome and Chromium. An attacker triggers it by luring a user to open a crafted HTML page, causing V8 to mishandle object types during execution. Successful exploitation yields arbitrary code execution inside the Chrome renderer's sandbox, typically chained with a separate sandbox escape for full host compromise. Anyone running Google Chrome prior to 90.0.4430.85, or Chromium as packaged by Debian and Fedora, is affected. Exploitation is confirmed in the wild: Google shipped the fix in April 2021 after active attacks, a public PoC exists (crbug.com/1195777), the bug was observed in exploit-kit attack chains, EPSS assigns an 84% probability of near-term exploitation, and CISA added it to the KEV catalog on 2021-11-03. Do: Update Google Chrome to 90.0.4430.85 or later immediately; Debian and Fedora users should apply the chromium package updates issued by their vendors, per CISA KEV required actions. There is no strong workaround short of disabling JavaScript or restricting browsing to trusted sites. Treat this as urgent, since the flaw was already used in real attacks and exploit-kit chains, where it was typically paired with a sandbox escape for full system compromise. | 8.8 | 84% | KEV PoC |
| masson the order of billions of users (Chrome's global install base exceeds 1 billion desktops; Chromium additionally ships in Debian and Fedora) |
Full article360 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananApr 21, 2021
Google on Tuesday released an update for Chrome web browser for Windows, Mac, and Linux, with a total of seven security fixes, including one flaw for which it says an exploit exists in the wild.
Tracked as CVE-2021-21224, the flaw concerns a type confusion vulnerability in V8 open-source JavaScript engine that was reported to the company by security researcher Jose Martinez on April 5
According to security researcher Lei Cao, the bug [1195777] is triggered when performing integer data type conversion, resulting in an out-of-bounds condition that could be used to achieve arbitrary memory read/write primitive.
"Google is aware of reports that exploits for CVE-2021-21224 exist in the wild," Chrome's Technical Program Manager Srinivas Sista said in a blog post.
The update comes after proof-of-concept (PoC) code exploiting the flaw published by a researcher named "frust" emerged on April 14 by taking advantage of the fact that the issue was addressed in the V8 source code, but the patch was not integrated into the Chromium codebase and all the browsers that rely on it, such as Chrome, Microsoft Edge, Brave, Vivaldi, and Opera.
The one-week patch gap meant the browsers were vulnerable to attacks until the patches posted in the open-source code repository were released as a stable update.
It's worth noting that Google halved the median "patch gap" from 33 days in Chrome 76 to 15 days in Chrome 78, which was released in October 2019, thereby pushing severe security fixes every two weeks.
The latest set of fixes also arrive close on the heels of an update the search giant rolled out last week with patches for two security vulnerabilities CVE-2021-21206 and CVE-2021-21220, the latter of which was demonstrated at the Pwn2Own 2021 hacking contest earlier this month.
Chrome 90.0.4430.85 is expected to roll out in the coming days. Users can update to the latest version by heading to Settings > Help > About Google Chrome to mitigate the risk associated with the flaws.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2021/04/update-your-chrome-browser-immediately.html