Mac, and Linux computers, you need to update your web browsing
software immediately to the latest version Google released earlier
today.
With the release of Chrome 78.0.3904.87, Google is warning
billions of users to install an urgent software update immediately
to patch two high severity vulnerabilities, one of which attackers
are actively exploiting in the wild to hijack computers.
Without revealing technical details of the vulnerability, the
Chrome security team only says that both issues are use-after-free
vulnerabilities, one affecting Chrome’s audio component
(CVE-2019-13720) while the other resides in the PDFium
(CVE-2019-13721) library.
The use-after-free vulnerability is a class of memory corruption
issues that allows corruption or modification of data in the
memory, enabling an unprivileged user to escalate privileges on an
affected system or software.
Thus, both flaws could enable remote attackers to gain
privileges on the Chrome web browser just by convincing targeted
users into visiting a malicious website, allowing them to escape
sandbox protections and run arbitrary malicious code on the
targeted systems.
Google Chrome Zero-Day Under Active Attacks
Discovered and reported by Kaspersky researchers Anton Ivanov and
Alexey Kulaev, the audio component issue in the Chrome application
has been found exploited in the wild, though it remains unclear at
the time which specific group of hackers.
“Google is aware of reports that an exploit for CVE-2019-13720
exists in the wild,” Google Chrome security team said in a blog
post[1].
“Access to bug details and links may be kept restricted until a
majority of users are updated with a fix. We will also retain
restrictions if the bug exists in a third party library that other
projects similarly depend on, but haven’t yet fixed.”
issue is one of the most common vulnerabilities discovered and
patched in the Chrome web browser in the past few months.
Just over a month ago, Google released an urgent security update
for Chrome to patch a total of four use-after-free
vulnerabilities in different components of the web browser, the
most severe of which could allow remote hackers to take control of
an affected system.
[3]
Chrome after miscreants were found actively exploiting a
similar use-after-free Chrome zero-day vulnerability in the wild
affecting the browser’s FileReader component.
Patch Available: Update Google Chrome Immediately
To patch both security vulnerabilities, Google has already started
rolling out Chrome version 78.0.3904.87 for Windows, Mac, and Linux
operating systems.
Although the Chrome web browser automatically notifies users
about the latest available version, users are recommended to
manually trigger the update process by going to “Help → About
Google Chrome” from the menu.
Besides this, Chrome users are also recommended to run all
software on their systems, whenever possible, as a non-privileged
user in an attempt to diminish the effects of successful attacks
exploiting any zero-day vulnerability.
We will update you with more information about these security
vulnerabilities as soon as Google releases their technical
details.
References
- ^
blog post
(chromereleases.googleblog.com) - ^
use-after-free issue
(thehackernews.com) - ^
four use-after-free vulnerabilities
(thehackernews.com) - ^
security update for Chrome
(thehackernews.com)
Read more http://feedproxy.google.com/~r/TheHackersNews/~3/nwmz_birPzk/chrome-zero-day-update.html