In some cases, this can lead to code execution. Type confusion can allow an attacker to feed function pointers or data into the wrong piece of code.
Type confusion vulnerabilities are programming flaws that happen when a piece of code doesn’t verify the type of object that is passed to it before using it.
The CVE for the zero-day is:ĬVE-2023-3079: a type confusion in V8 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. The Common Vulnerabilities and Exposures (CVE) database lists publicly disclosed computer security flaws. This could indicate that Google found this vulnerability while researching an active attack, which matches the fact that an exploit for the vulnerability exists in the wild. The vulnerability was reported by Clément Lecigne of Google's Threat Analysis Group. Access to bug details and links may be kept restricted until a majority of users are updated with a fix. However, from the update page we can learn a few things. Google never gives out a lot of information about vulnerabilities, for obvious reasons. Then all you have to do is relaunch the browser in order for the update to complete.Īfter the update the version should be 1.106 for Mac and Linux, and 1.110 for Windows, or later.
If there is an update available, Chrome will notify you and start downloading it. My preferred method is to have Chrome open the page chrome://settings/help which you can also find by clicking Settings > About Chrome. And now would be a good time, given the severity of the vulnerabilities in this batch. So, it doesn’t hurt to check now and then. But you can end up lagging behind if you never close the browser or if something goes wrong-such as an extension stopping you from updating the browser. The easiest way to update Chrome is to allow it to update automatically, which basically uses the same method as outlined below but does not require your attention. Android users will also find an update waiting. If you’re a Chrome user on Windows, Mac, or Linux, you should update as soon as possible. One of these security fixes is for a zero-day about which Google says it’s aware that an exploit for this vulnerability exists in the wild. Google has released an update which includes two security fixes.
0 kommentar(er)
