Google Chrome Hit by Second Zero-Day Attack – Urgent Patch Update Released

Cyber Security

Apr 19, 2023Ravie LakshmananBrowser Security / Zero-Day

Google on Tuesday rolled out emergency fixes to address another actively exploited high-severity zero-day flaw in its Chrome web browser.

The flaw, tracked as CVE-2023-2136, is described as a case of integer overflow in Skia, an open source 2D graphics library. Clément Lecigne of Google’s Threat Analysis Group (TAG) has been credited with discovering and reporting the flaw on April 12, 2023.

“Integer overflow in Skia in Google Chrome prior to 112.0.5615.137 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page,” according to the NIST’s National Vulnerability Database (NVD).

The tech giant, which also fixed seven other security issues with the latest update, said it’s aware of active exploitation of the flaw, but did not disclose additional details to prevent further abuse.

The development marks the second Chrome zero-day vulnerability to be exploited by malicious actors, and comes merely days after Google patched CVE-2023-2033 last week. It’s not immediately clear if the two zero-days have been chained together as part of in-the-wild attacks.

Users are recommended to upgrade to version 112.0.5615.137 for Windows, macOS, and Linux to mitigate potential threats. Users of Chromium-based browsers such as Microsoft Edge, Brave, Opera, and Vivaldi are also advised to apply the fixes as and when they become available.

Found this article interesting? Follow us on Twitter and LinkedIn to read more exclusive content we post.

Articles You May Like

Samsung One UI 5 Watch Beta Update for Galaxy Watch 4, Galaxy Watch 5 Rolling Out: Report
Apple Vision Pro Mixed Reality Headset Launch Impressions: Almost Unbelievable, Very Real
Cloud Security Tops Concerns for Cybersecurity Leaders: EC-Council’s Certified CISO Hall of Fame Report 2023
YouTube to Stop Removing Content Spreading Misinformation on Past Elections as Part of New Policy
Apple Acquires AR Headset Startup Mira: Report