Update Google Chrome Browser to Patch New Zero-Day Exploit Detected in the Wild

Google on Monday shipped security updates to address a
high-severity zero-day vulnerability in its Chrome web browser that
it said is being exploited in the wild.

The shortcoming, tracked as CVE-2022-2294^[1], relates to a heap
overflow flaw in the WebRTC^[2]
component that provides real-time audio and video communication
capabilities in browsers without the need to install plugins or
download native apps.

Heap buffer overflows, also referred to as heap overrun or heap
smashing, occur when data is overwritten in the heap area of the memory^[3], leading to arbitrary
code execution or a denial-of-service (DoS) condition.

“Heap-based overflows can be used to overwrite function pointers
that may be living in memory, pointing it to the attacker’s code,”
MITRE explains^[4]. “When the consequence
is arbitrary code execution, this can often be used to subvert any
other security service.”

Credited with discovering and reporting the flaw on July 1,
2022, is Jan Vojtesek from the Avast Threat Intelligence team. It’s
worth pointing out that the bug also impacts^[5]
the Android version of Chrome.

As is usually the case with zero-day exploitation, details
pertaining to the flaw as well as other specifics related to the
campaign have been withheld to prevent further abuse in the wild
and until a significant chunk of users are updated with a fix.

CVE-2022-2294 also marks the resolution of the fourth zero-day
vulnerability in Chrome since the start of the year –

Users are recommended to update to version 103.0.5060.114 for
Windows, macOS, and Linux and 103.0.5060.71 for Android to mitigate
potential threats. Users of Chromium-based browsers such as
Microsoft Edge, Brave, Opera, and Vivaldi are also advised to apply
the fixes as and when they become available.