The updates come on the heels of news of attacks exploiting another zero-day in Chrome in tandem with a previously-unknown Windows flaw
Two weeks after patching an actively-exploited vulnerability affecting Chrome for desktop, Google is squashing another zero-day bug in the browser’s version for Windows, macOS, and Linux. Within hours, Google also pushed out an update for Chrome for Android to plug yet another security loophole that is being exploited in the wild.
Today Chrome fixed two more vulnerabilities that were being actively exploited in the wild (discovered by Project Zero/Google TAG last week). CVE-2020-16009 is a v8 bug used for remote code execution, CVE-2020-16010 is a Chrome sandbox escape for Android. https://t.co/IOhFwT0Wx1
— Ben Hawkes (@benhawkes) November 2, 2020
The bug, classified as high-severity, was discovered by researchers from Google’s Threat Analysis Group and Project Zero. Details about the vulnerability are very sparse due to Google’s policy that clearly states that “access to bug details and links may be kept restricted until a majority of users are updated with a fix.”
Per the National Vulnerability Database, the flaw “could allow an attacker to potentially exploit heap corruption via a crafted HTML page.”
RELATED READING: Security terms explained: What does Zero Day mean?
Users would do well to update their browsers to the latest version (86.0.4240.183) as soon as possible. If you have automatic updates enabled, your browser should update by itself. Otherwise you’ll have to do it manually by navigating to the About Google Chrome section, which can be found under Help in the side menu.
The update brings fixes for a total of 10 vulnerabilities, with Google specifically listing seven high-risk flaws where the fixes were contributed by external researchers.
The news comes on the heels of another disclosure by Google about a zero-day in Windows that was found to be exploited in tandem with the Chrome zero-day revealed two weeks ago.
Meanwhile, Google also confirmed that the flaw affecting Chrome for Android has been actively exploited by attackers as well. Indexed as CVE-2020-16010 and ranked as high in severity, the vulnerability is caused by a heap buffer overflow in the User Interface (UI) in Chrome for Android. It could enabled a remote threat actor who has compromised the renderer process to execute a sandbox escape using a crafted HTML page.
You shouldn’t hold off on updating to the latest Chrome version for Android (86.0.4240.185) once the update becomes available.