Zero-day Chrome/Windows combo actively exploited in the wild
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2019-5786 | Actively Exploited Use-After-Free in Google Chrome Blink CVE-2019-5786 is a use-after-free (object lifetime) flaw in Blink, the rendering engine of Google Chrome, fixed in Chrome 72.0.3626.121. A remote attacker triggers it by luring a user to a crafted HTML page, where the stale object allows an out-of-bounds memory access within the renderer process. Successful exploitation produces memory corruption in the browser renderer — scored in the CVSS vector primarily as high availability impact — and Google disclosed the flaw being actively exploited in targeted attacks, reportedly chained with a separate Windows zero-day that Microsoft patched out of band in March 2019. Anyone running Chrome older than 72.0.3626.121 was affected, which at disclosure time meant a large share of Chrome's billion-plus desktop user base. Exploitation is confirmed in the wild: the issue was a zero-day before the patch, it was added to CISA's Known Exploited Vulnerabilities catalog on 2022-05-23, and EPSS assigns a ~61.5% probability of exploitation within 30 days (99th percentile). Do: Update Chrome to 72.0.3626.121 or later — verify via the browser's About/Settings help page and relaunch any pending auto-update, since Chrome self-updates but requires a relaunch. Treat as a KEV priority and patch per vendor instructions, and apply Microsoft's March 2019 updates, including the out-of-band Windows fix, because the Chrome flaw was used in combination with a Windows zero-day in the observed targeted attacks. | 6.5 | 62% | KEV PoC |
| mass≈1 billion+ Chrome users/installations at the time (all Chrome deployments on versions before 72.0.3626.121) |
Full article376 words · extracted from helpnetsecurity.com · click to collapse
We now know why a number of Googlers made a point to urge users to implement the latest Chrome update as soon as possible: the vulnerability (CVE-2019-5786) is definitely being actively exploited in conjunction with another zero-day in Windows.
The danger of a Chrome / Windows exploit
The Windows bug is a local privilege escalation in the Windows win32k.sys kernel driver that can be used as a security sandbox escape, says Google threat analyst Clement Lecigne.
“We strongly believe this vulnerability may only be exploitable on Windows 7 due to recent exploit mitigations added in newer versions of Windows. To date, we have only observed active exploitation against Windows 7 32-bit systems,” he shared.
Google reported the bug to Microsoft and Microsoft has confirmed that they are working on a fix.
In the meantime, Google decided to publicly disclose its existence as it’s serious, can still be used to elevate privileges or combined with another browser vulnerability to evade security sandboxes, and is being actively exploited in targeted attacks.
What can users do about it?
Lecigne advised users to consider upgrading to Windows 10 if they are still running an older version of Windows, and to apply Windows patches from Microsoft when they become available.
Engineering Director on Google Chrome Justin Schuh also explained why many Googlers called out this attack more prominently than previous zero-day attacks against Chrome.
“Past 0days targeted Chrome by using Flash as the first exploit in the chain. Because Flash is a plugin component, we could update it separately, and once updated Chrome would silently switch to the fixed Flash, without a browser restart or any user intervention,” he noted.
“This newest exploit is different, in that initial chain targeted Chrome code directly, and thus required the user to have restarted the browser after the update was downloaded. For most users the update download is automatic, but restart is a usually a manual action.”
So, if you’re using Chrome, you might want to check whether it has already been automatically upgraded to the latest version (v72.0.3626.121 for both the desktop and mobile versions) and restart your device once the update is implemented.
A security update for Chrome OS that fixes the flaw has also been provided.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2019/03/08/chrome-windows-exploit/