Google has released Chrome 90.0.4430.85 to address an actively exploited zero-day and four other high severity security vulnerabilities impacting today's most popular web browser.
The version released on April 20th, 2021, to the Stable desktop channel for Windows, Mac, and Linux users will be rolling out to all users over the coming weeks.
'Google is aware of reports that exploits for CVE-2021-21224 exist in the wild,' the company's announcement reads.
With Google Bookmarks, you can save shortcuts to your favorite webpages and navigate to them in seconds from anywhere. Discover great apps, games, extensions and themes for Google Chrome. Discover great apps, games, extensions and themes for Google Chrome. Chrome Web Store Sort by: Recommended. View translations easily as you browse the web. By the Google Translate team. Google Translate. Quickly access Skype for Web and Share on. Google's long-standing push for greater adoption of secure HTTPS browsing takes another step forward, as the v90 edition of Chrome hits the stable channel for desktops starting today.
PoC dropped on Twitter, zero-day fixed one week later
Google did not share any details on the zero-day besides describing it as a 'Type Confusion in V8' and saying that it was reported by VerSprite Inc's Jose Martinez.
However, Martinez linked it to a proof-of-concept (PoC) exploit publicly shared on Twitter one week ago after his initial Chrome Vulnerability Reward Program report from April 5th.
This remote code execution vulnerability cannot be exploited by attackers to escape Chromium's sandbox security feature (a security feature designed to block exploits from accessing files or executing code on host computers).
However, it can easily be chained with another security bug that can allow the exploit to escape the sandbox and execute arbitrary code on the targeted users' systems.
The zero-day PoC for CVE-2021-21224 was dropped on Twitter one day after Google released Chrome 89.0.4389.128 to fix another zero-day bug with a PoC exploit publicly shared two days earlier.
hi haha right, I'm the original reporter.
Timeline:
5th April: I've submitted my bug to Google Chrome VRP report
12th April: I've submitted my RCE 0day exploit
12th April: Google patched v8 engine, but also made regress/unittest public
14th April: people viralized 1day exploit
No details on zero-day attacks in the wild
Although Google says that it is aware CVE-2020-16009 active exploitation, the company did not provide any info on the threat actors behind these attacks.
'Access to bug details and links may be kept restricted until a majority of users are updated with a fix,' Google said.
'We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven't yet fixed.'
Google fixed three other high severity vulnerabilities in Chrome 90.0.4430.85:
- CVE-2021-21222: Heap buffer overflow in V8. Reported by Guang Gong of Alpha Lab, Qihoo 360 on 2021-03-30
- CVE-2021-21223: Integer overflow in Mojo. Reported by Guang Gong of Alpha Lab, Qihoo 360 on 2021-04-02
- CVE-2021-21225: Out of bounds memory access in V8. Reported by Brendon Tiszka (@btiszka) supporting the EFF on 2021-04-05
- CVE-2021-21226: Use after free in navigation. Reported by Brendon Tiszka (@btiszka) supporting the EFF on 2021-04
Related Articles:
The update patches a total of seven security flaws in the desktop versions of the popular web browser
Google has released an update for its Chrome web browser that fixes a range of security flaws, including a zero-day vulnerability that is known to be actively exploited by malicious actors. The bugs affect the Windows, macOS, and Linux versions of the popular browser.
'Google is aware of reports that exploits for CVE-2021-21224 exist in the wild,' said Google about the newly disclosed zero-day vulnerability that stems from a type confusion bug in the V8 JavaScript engine that is used in Chrome and other Chromium-based web browsers.
Beyond the zero-day flaw, the new release fixes six other security loopholes, with Google specifically listing four high-severity vulnerabilities where fixes were contributed by external researchers. The first, indexed as CVE-2021-21222, also affects the V8 engine, however this time it is a heap buffer-overflow bug.
The second flaw, tracked as CVE-2021-21225, also resides in the V8 component and manifests as an out-of-bounds memory access bug. As for CVE-2021-21223, it is found to affect Mojo as an integer overflow bug. The fourth high-severity vulnerability, labeled CVE-2021-21226, is a use-after-free flaw found in Chrome's navigation.
READ NEXT: Google: Better patching could have prevented 1 in 4 zero‑days last year
'Successful exploitation of the most severe of these vulnerabilities could allow an attacker to execute arbitrary code in the context of the browser. Depending on the privileges associated with the application, an attacker could view, change, or delete data,' warned the Center for Internet Security.
As is common with such releases, the tech titan has not disclosed any further details about the security loopholes until most users have had a chance to update their web browsers to the newest available version, mitigating the chance of the vulnerabilities being exploited by threat actors.
The Government Computer Emergency Response Team Hong Kong (GovCERT.HK) issued a security alert advising users and system administrators to update their browsers. 'Users of affected systems should update the Google Chrome to version 90.0.4430.85 to address the issue,' said the agency.
Google Chrome Website Permissions
Considering the disclosed vulnerabilities, users would do well to update their browsers to the latest version (90.0.4430.85) as soon as practicable. If you have automatic updates enabled, your browser should update by itself. You can also manually update your browser by visiting the About Google Chrome section, which can be found under Help in the menu bar.
Google Chrome Website Browser
Discussion
