Google patches chrome zero-day vulnerabilities being exploited in the wild

2021-09-16T15:02:56
ID HIVEPRO:8AF52D0A3BB6DDEEAC663A63DA954039
Type hivepro
Reporter Hive Pro
Modified 2021-09-16T15:02:56

Description

THREAT LEVEL: Red.

For a detailed advisory, download the pdf file here.

Google just released a major security update for Google Chrome that addresses eleven vulnerabilities, including two zero-day flaws that have been exploited in the wild. A remote attacker might take use of the flaws by tricking an unsuspecting victim into visiting a specially designed website they generated, which would cause a type confusion error, allowing them to run arbitrary code on the affected system. Users are advised to update their browsers to the latest version (91.0.4472.164) as soon as practicable.

Vulnerability Details

CVE ID| Affected CPEs| Vulnerability Name
---|---|---
CVE-2021-30632| cpe:2.3:a:google:chrome::::::::| Out of bounds write in V8 JavaScript Engine
CVE-2021-30633| cpe:2.3:a:google:chrome::::::::| Use after free in the Indexed DB API.
CVE-2021-30625| cpe:2.3:a:google:chrome::::::::| Use after free in Selection API
CVE-2021-30626| cpe:2.3:a:google:chrome::::::::| Out of bounds memory access in ANGLE
CVE-2021-30627| cpe:2.3:a:google:chrome::::::::| Type Confusion in Blink layout
CVE-2021-30628| cpe:2.3:a:google:chrome::::::::| Stack buffer overflow in ANGLE
CVE-2021-30629| cpe:2.3:a:google:chrome::::::::| Use after free in Permissions
CVE-2021-30630| cpe:2.3:a:google:chrome::::::::| Inappropriate implementation in Blink
CVE-2021-30631| cpe:2.3:a:google:chrome::::::::| Type Confusion in Blink layout

References

<https://threatpost.com/google-chrome-zero-day-exploited/169442/>

<https://www.securitymagazine.com/articles/96096-google-patches-chrome-zero-day-exploited-in-the-wild>