Google has released a Chrome update that closes eleven security weaknesses, two of which were already being exploited against people before the fix arrived. It is one more chapter in the long human effort to keep shared digital spaces safe from those who would turn their openings to harm. The flaws are memory errors that can crash a browser or, in worse hands, open the way to taking control of a machine. Google has not yet said who is responsible or how the attacks unfolded, so the full shape of this story remains unfinished.
Google Patches Eleven Chrome Flaws, Including Two Zero-Days Already Exploited in the Wild
Chrome has become a clear favorite for attackers
Mark
Eleven flaws patched, but everyone is talking about two. Why those two?
Mimi
Because Google says they were already being exploited in the wild. That makes them zero-days: attackers had them before the fix existed.
Mark
What kind of bugs are they?
Mimi
Memory bugs. One is an out-of-bounds write in the V8 JavaScript engine, the other a use-after-free in the Indexed DB API.
Luke
Worth being careful here. Memory bugs can lead to remote code execution and sandbox escapes, but the reporting says they can, not that these two did. Google hasn't shared attack details.
Mark
So we don't know who was attacked?
Luke
No. We don't know who, how many, or by whom. The only detail is that both were submitted anonymously on September 8.
Mimi
And there's the count of ten Chrome zero-days patched this year, which is attributed to reporting rather than a figure Google stated in the notes.
Mark
What about the warning that exploitation will rise?
Luke
That's John Bambenek's prediction, one expert's view. It's plausible, since patches are public, but it's not an observed fact yet.
Mimi
Which is why the advice is simple: update Chrome.
Der Puls
- Two flaws in Chrome were already being used in live attacks before Google could close them.
- Both bugs are memory errors that can crash the browser or, when abused, allow code to run where it should not.
- One of the flaws was reported anonymously, and Google has not revealed who was behind the attacks or who was targeted.
- Experts warn that exploitation will likely climb now that the fixes are public, while many users have not yet installed the update.
- The fix is available now, and updating Chrome is the immediate action that protects users from the danger.
Google has released a Chrome update that closes eleven security weaknesses, two of which were already being exploited against people before the fix arrived. It is one more chapter in the long human effort to keep shared digital spaces safe from those who would turn their openings to harm. The flaws are memory errors that can crash a browser or, in worse hands, open the way to taking control of a machine. Google has not yet said who is responsible or how the attacks unfolded, so the full shape of this story remains unfinished.
Google has shipped a new version of Chrome that closes eleven security vulnerabilities. Two of them were already being used in attacks before the fix was released, and the company confirmed it knows of exploitation in the wild for both. They are tracked as CVE-2021-30632 and CVE-2021-30633.
Both are memory bugs. One is an out-of-bounds write in V8, the JavaScript engine inside the browser. The other is a use-after-free flaw in the Indexed DB API, which manages databases inside the browser. Such bugs often show up first as a simple crash, but they can also be turned toward remote code execution and sandbox escapes, which is why attacks using them matter.
One detail stands out. Of the eleven flaws, these two were the only ones submitted anonymously, on September 8. Google has not said who was behind the attacks, how they worked, or who was targeted.
The two fixes raise the number of Chrome zero-days patched in 2021 to ten. Security researchers read this as a sign that attackers see the browser as a prized route to millions of devices on any operating system. John Bambenek of Netenrich expects exploitation to rise now that the flaws are public, since the patch itself shows others what changed, and many people have not yet updated.
For Chrome users, the message is simple: install the latest release now. How far these attacks reached remains unknown for the time being.
Google has shipped a new version of Chrome that closes eleven security vulnerabilities, and two of them were already being used in attacks before the fix arrived. The company said it is aware of exploitation in the wild for both flaws, which are tracked as CVE-2021-30632 and CVE-2021-30633.
The release notes describe both as memory bugs. CVE-2021-30632 is an out-of-bounds write in V8, the JavaScript engine built into the browser. CVE-2021-30633 is a use-after-free bug in the Indexed DB API, a JavaScript interface for managing a NoSQL database of JSON objects inside the browser.
Memory flaws of this kind often show up as nothing more than a browser crash. BleepingComputer, which reported on the release, noted that they can also be turned to more serious ends, including remote code execution and sandbox escapes. That is why a pair of them being used in live attacks draws attention.
One detail stands out in the disclosure. Of the eleven vulnerabilities, these two were the only ones listed as submitted anonymously, and the submission date was September 8. Google has not said who was behind the attacks or how they were carried out, and it has shared no details about the targets.
According to reporting on the release, the two fixes bring the number of zero-day vulnerabilities patched in Chrome during 2021 to ten. Kevin Dunne, president of the cybersecurity vendor Pathlock, told ZDNet the count shows how much attention attackers are giving to browsers. In his words, Chrome has become a clear favorite because it offers a streamlined route to millions of devices regardless of operating system.
John Bambenek, principal threat hunter at Netenrich, also spoke to ZDNet and took the point further. Now that the vulnerabilities have been patched, he said, users should expect exploitation to go up. The reasoning is that a public fix gives others a way to study what changed, while many people have yet to update.
For Chrome users, the practical step is to install the latest release. Google's silence on the attacks means the full scope of the exploitation remains unknown for now.
Bemerkenswerte Zitate
Chrome has become a clear favorite, offering a streamlined way to gain access to millions of devices regardless of OS.— Kevin Dunne, president, Pathlock, to ZDNet
Now that the flaws are patched, users can expect exploitation to go up.— John Bambenek, principal threat hunter, Netenrich, to ZDNet (paraphrased)
Möchten Sie die ganze Geschichte?
Das Original lesen bei TechRadar ↗
Media & Entertainment