Google has begun sending a new Chrome release to desktop users on Windows, Mac and Linux, because two flaws in the browser were already being exploited in the wild before most people knew they existed. It is the third such emergency patch this year, arriving after the earlier fixes that Google's own researchers had traced, and this time the warnings came from anonymous sources whose motives and methods remain unexplained. The company has not yet said whether the two weaknesses were used together or apart, leaving a quiet question hanging over an otherwise routine act of repair.
Google Patches Two Chrome Zero-Days on Windows, Mac and Linux in Third Emergency Update of the Series
Both new flaws came from anonymous sources, not Google's own researchers.
Mark
So what actually happened here? Another Chrome update?
Mimi
Yes, version 86.0.4240.198 for Windows, Mac and Linux. It fixes two zero-days, CVE-2020-16013 in the V8 JavaScript engine and CVE-2020-16017, a use after free in site isolation.
Mark
Zero-day means attackers were already using them?
Mimi
The reporting says they were discovered in the wild, so yes, that's the framing. This is the third desktop update in the series, after October and last week.
Luke
Worth being careful there. We know Google labeled them as found in the wild. We don't know who exploited them, against whom, or how widely.
Mark
What's different about these two?
Mimi
The earlier ones were reported by Google's own researchers, including Project Zero. These came from anonymous sources.
Luke
And that anonymity is the gap. We can't say who found them or why they stayed unnamed. Nothing in the reporting speaks to that.
Mark
Were the two used together?
Luke
Unknown. Google hasn't said whether they were exploited together or separately, so any talk of a chained attack would be a guess.
Mimi
For readers the useful part is practical: Help, then About Google Chrome. The rollout is staged, so don't just wait for it.
Mark
And Android?
Mimi
It got its own fix last week, version 86.0.4240.185, for CVE-2020-16010 in the user interface component.
Il Polso
- Two zero-day flaws were already being exploited in the wild before Google could close them.
- This is the third emergency desktop patch this year, following October's and last week's fixes.
- Unlike earlier bugs found by Google's own researchers, these were reported by anonymous sources, raising uncertainty about their origin.
- Users are being urged to check Help > About Google Chrome now, since the staged rollout means updates will reach people unevenly.
- Google has not yet said whether the two flaws were chained in a single attack, so the full picture is still forming.
Google has begun sending a new Chrome release to desktop users on Windows, Mac and Linux, because two flaws in the browser were already being exploited in the wild before most people knew they existed. It is the third such emergency patch this year, arriving after the earlier fixes that Google's own researchers had traced, and this time the warnings came from anonymous sources whose motives and methods remain unexplained. The company has not yet said whether the two weaknesses were used together or apart, leaving a quiet question hanging over an otherwise routine act of repair.
Google is pushing a new version of Chrome, 86.0.4240.198, to desktop users on Windows, Mac and Linux. The reason is a pair of zero-day vulnerabilities, flaws that were found being used in real attacks before a fix existed. It is the third desktop update in this run of such fixes, following one in October and another last week.
The two flaws are CVE-2020-16013, an inappropriate implementation in the V8 JavaScript engine, and CVE-2020-16017, a use-after-free memory corruption bug in site isolation. What sets them apart from earlier fixes is who found them. The previous three were reported by Google's own researchers. These two came from anonymous sources, and Google has not made clear whether they were used together in one attack or separately.
For ordinary users the step is simple: open the three-dot menu, go to Help, then About Google Chrome, and let the browser check for the update. Because the rollout is staged, waiting may mean the patch arrives later than it could have. Whether Google will say more about how these flaws were exploited is the open question to watch.
Google has started pushing a new version of Chrome to desktop users on Windows, Mac and Linux, and the reason is a pair of zero-day vulnerabilities that were found being used in the wild. The release is version 86.0.4240.198. It is the third desktop update in this run of zero-day fixes, following one in October and another just last week.
The two flaws are tracked as CVE-2020-16013 and CVE-2020-16017. According to Google's blog post about the release, the first is described as an inappropriate implementation in V8, the browser's JavaScript engine, and was reported on November 9. The second is a memory corruption bug, a use after free in site isolation, and was reported on November 7.
One detail separates these two from the earlier ones. The three previous zero-day fixes in this series were reported by Google's own researchers. Both of the new flaws came from anonymous sources, which Google notes in its disclosure. What the company has not made clear is whether the two vulnerabilities were exploited together, as part of a single attack, or separately.
The earlier fixes give the run its shape. In October, Google patched CVE-2020-15999 with version 86.0.4240.111. That bug sat in the FreeType font engine and was reported by a researcher on Google's Project Zero team. Last week, version 86.0.4240.183 addressed CVE-2020-16009, another bug in the V8 engine.
Android has had its own fix. A few days ago Google released Chrome for Android version 86.0.4240.185 to close a separate zero-day, CVE-2020-16010, which Project Zero identified. That flaw existed in the browser's user interface component.
For users, the practical step is simple. Click the three-dot menu at the top right of the Chrome window, go to Help, then About Google Chrome, and the browser will check for the update. The rollout is happening in stages, so it may take some time to reach everyone, and checking manually is the way to avoid waiting.
What to watch next is whether Google says more about how the two anonymously reported flaws were exploited, and whether they were chained, as the update reaches all users.
Citazioni salienti
Both vulnerabilities were reported by anonymous sources; it is unclear whether they were exploited together or separately.— Google, via its Chrome release blog post (paraphrased)
Vuoi la storia completa?
Leggi l'originale su Gadgets 360 ↗
Technology