Lucene search

K
thnThe Hacker NewsTHN:2E90A09BA23747C57B4B5C9ED7D13ED9
HistoryJul 05, 2022 - 2:55 a.m.

Update Google Chrome Browser to Patch New Zero-Day Exploit Detected in the Wild

2022-07-0502:55:00
The Hacker News
thehackernews.com
435
google chrome
zero-day exploit
security update
cve-2022-2294
webrtc
heap overflow
android
cve-2022-0609
cve-2022-1096
cve-2022-1364
chromium
google project zero

EPSS

0.041

Percentile

92.2%

Google Chrome Browser

Google on Monday shipped security updates to address a high-severity zero-day vulnerability in its Chrome web browser that it said is being exploited in the wild.

The shortcoming, tracked as CVE-2022-2294, relates to a heap overflow flaw in the WebRTC component that provides real-time audio and video communication capabilities in browsers without the need to install plugins or download native apps.

Heap buffer overflows, also referred to as heap overrun or heap smashing, occur when data is overwritten in the heap area of the memory, leading to arbitrary code execution or a denial-of-service (DoS) condition.

โ€œHeap-based overflows can be used to overwrite function pointers that may be living in memory, pointing it to the attackerโ€™s code,โ€ MITRE explains. โ€œWhen the consequence is arbitrary code execution, this can often be used to subvert any other security service.โ€

Credited with reporting the flaw on July 1, 2022, is Jan Vojtesek from the Avast Threat Intelligence team. Itโ€™s worth pointing out that the bug also impacts the Android version of Chrome.

As is usually the case with zero-day exploitation, details pertaining to the flaw as well as other specifics related to the campaign have been withheld to prevent further abuse in the wild and until a significant chunk of users are updated with a fix.

CVE-2022-2294 also marks the resolution of the fourth zero-day vulnerability in Chrome since the start of the year -

Users are recommended to update to version 103.0.5060.114 for Windows, macOS, and Linux and 103.0.5060.71 for Android to mitigate potential threats. Users of Chromium-based browsers such as Microsoft Edge, Brave, Opera, and Vivaldi are also advised to apply the fixes as and when they become available.

The disclosure shortly follows a report from Google Project Zero, which noted that a total of 18 security vulnerabilities have been exploited as unpatched zero-days in the wild so far this year.

Found this article interesting? Follow THN on Facebook, Twitter ๏‚™ and LinkedIn to read more exclusive content we post.