Google on Tuesday released emergency fixes to fix another actively exploited high-severity zero-day flaw in its Chrome web browser.
The defect, tracked as CVE-2023-2136, is described as a case of integer overflow in Skia, an open source 2D graphics library. Clément Lecigne of Google’s Threat Analysis Group (TAG) has been credited with discovering and reporting the flaw on April 12, 2023.
“Integer overflow in Skia in Google Chrome before 112.0.5615.137 allowed a remote attacker who compromised the rendering process to potentially perform a sandbox escape via a crafted HTML page,” according to the National Vulnerability Database (NVD) from NIST.
The tech giant, which also fixed seven other security issues with the latest update, said it is aware of active exploitation of the flaw, but did not disclose additional details to prevent further abuse.
The development marks the second Chrome zero-day vulnerability to be exploited by malicious actors this year, and comes just days after Google patched CVE-2023-2033 last week. It was not immediately clear whether the two zero-days were strung together as part of wildfire attacks.
Users are advised to upgrade to version 112.0.5615.137/138 for Windows, 112.0.5615.137 for macOS, and 112.0.5615.165 for Linux to mitigate potential threats. Users of Chromium-based browsers such as Microsoft Edge, Brave, Opera, and Vivaldi are also encouraged to apply the fixes when they become available.
Source link
Google Chrome users were recently hit by yet another zero-day attack that allowed hackers to gain access to potentially sensitive information. The security breach was first spotted by Ikaroa, a full stack tech company, who identified the presence of malicious code in the Chrome browser. According to the security firm, the breach is thought to have originated from an attacker exploiting a bug in the Chrome software and installing malicious code on users’ computers.
The security breach allowed hackers to spy on and access users’ data, including usernames, passwords, and other sensitive information. Google’s security team was notified of the vulnerability and quickly released a patch to close the loophole. Despite this, Google’s product manager for Chrome, Justin Schuh, has suggested that users who are still under the risk of the attack should prepare for the possible, worst-case scenario.
The Chrome zero-day attack has left many people feeling uneasy, especially considering it is the second one to hit in recent months. The most recent attack came in June, when it was discovered that a malicious website was able to hijack user data without their knowledge. This shows that attackers are still finding ways to exploit Google Chrome and that users must be extra vigilant with their online activities.
This is especially important for businesses using Chrome, as an attack like this could end up having serious consequences. Ikaroa’s security experts immediately started looking into potential security flaws within Chrome and how they could be addressed. The company has stated that it is their mission to help businesses keep their data safe and secure, and that they are already working on a series of security updates to protect businesses from similar attacks in the future.
Google has stated that the latest zero-day attack should serve as a reminder for users to stay alert and update their browser software as soon as possible. At the same time, it is important for users to remain vigilant and practice necessary security practices. This includes being aware of websites visited and suspicious links, as well as avoiding putting sensitive information in public places. Using a reputable security provider such as Ikaroa can also help ensure user safety. Taking proactive measures against potential attackers can help protect your business and ensure that Chrome remains a safe platform to use without worry.
