Connect with us

Hi, what are you looking for?

Hard News Hard Hitting News Source Global Political News

Cyber Security

High-Severity Chrome Bugs Allow Browser Hacks

New york, USA - july 26, 2019: Start google chrome application on computer macro close up view in pixel screen

Desktop versions of the browser received a total of eight fixes, half rated high-severity.

Google has updated its Chrome web browser, fixing four bugs with a severity rating of “high” and eight overall. Three are use-after-free flaws, which could allow an adversary to generate an error in the browser’s memory, opening the door to a browser hack and host computer compromise.

On Friday, the Cybersecurity and Infrastructure Security Agency (CISA) issued a security bulletin urging users and infosec administrators to apply the update. The agency warned that the vulnerabilities can be used by an attacker “to take control of an affected system.”

According to Google’s December security bulletin, previous Windows, macOS and Linux versions of the Chrome desktop browser are vulnerable to attacks. An updated 87.0.4280.88 version of Chrome addresses the bugs and will “roll out over the coming days/weeks,” Google wrote.

How to Manually Update Your Chrome Browser

To manually update your Chrome browser, visit Chrome’s customization drop-down menu in the upper-right hand side of the client. From that menu select “Help” and then “About Google Chrome.” Opening that menu item automatically triggers Chrome to look for updates.

Details tied to each of the bugs are being withheld at this time, Google said, “until a majority of users are updated with a fix.” It also noted that when and if bugs exist in third-party code libraries used in other devices or platforms, technical details of the bugs will be limited.

Bug Breakdowns: Unique Linux Flaw

Three high-severity bugs each include use-after-free elements impacting memory, tied to Chrome’s clipboard, media and extensions components. The bugs are tracked as CVE-2020-16037, CVE-2020-16038 and CVE-2020-16039.

The fourth high-severity bug (CVE-2020-16040) impacts Google’s open-source and high-performance JavaScript and WebAssembly engine, called V8. The bug is identified as an insufficient-data-validation flaw, which in some cases opens targets to cross-site scripting attacks.

Google’s V8 JavaScript engine also received a second patch this month — one of two medium-severity bugs reported this December. Tracked as CVE-2020-16042, that issue is identified as an “uninitialized-use” bug impacting V8. It’s unclear from Google’s bulletin the exact nature of the flaw. But cybersecurity researchers have described these types of uninitialized-use bugs as “largely overlooked” and often “regarded as insignificant memory errors.”

“[These] are actually a critical attack vector that can be reliably exploited by hackers to launch privilege-escalation attacks in the Linux kernel,” according to 2017 research published by the Georgia Institute of Technology.

A second medium-severity bug (CVE-2020-16041) is an “out-of-bounds read in networking” vulnerability. This could allow an adversary to improperly access objects in memory. While technical details of the CVE are also being withheld, this type of vulnerability could allow an unauthenticated adversary to send a malformed message to vulnerable software. Due to insufficient validation of the message, the targeted program could be forced to crash.

Google acknowledged several security researchers that contributed to identifying this month’s bugs. Ryoya Tsukasaki was thanked for finding the use-after-free bug (CVE-2020-16037) in the Chrome clipboard, which earned the researcher a $5,000 bug bounty. Khalil Zhani, Lucas Pinheiro, Sergei Glazunov, André Bargull and Mark Brand were also credited for their bug-hunting efforts.

Source: https://threatpost.com/google_chrome_bugs_patched/161907/

Click to comment

Leave a Reply

Your email address will not be published. Required fields are marked *

You May Also Like

Cyber Security

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has given federal agencies three weeks to secure Adobe ColdFusion servers on their networks against two...

Cyber Security

Businesses and developers are focusing more on the security of applications in their digital environment as cyber threats and data breaches continue escalating. The...

Cyber Security

HCL BigFix is an endpoint management platform that has the capability to automate discovery, management, and remediation. It can find and fix vulnerabilities on...

Cyber Security

The Environmental Protection Agency cited a lack of resources and the sheer volume of critical vulnerabilities as the reasons for its inability to patch...

Copyright © 2023 Hard News Herd Hitting in Your Face News Source | World News | Breaking News | US News | Political News Website by Top Search SEO