Google Chrome Zero-Day Is Being Weaponized

Google has released 95.0.4638.69 today to the Stable Channel to resolve serious issues impacting Windows, Linux and Mac OS.  So far this year Google have released over 13 Zero Day versions of the Chrome browser so far.  This vulnerability is being tracked under CVE-2021-38000 and CVE-2021-38003 and are both Critical Severity.

A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

What’s the solution?

Upgrade to the latest version of Chrome stable channel using Syxsense Secure.

Syxscore Risk Alert

his vulnerability has a serious risk as this can be exposed over any network, with low complexity and without privileges.  The CVE carries a CVSS score of 8.8 (High Severity) and the vulnerability is being weaponized.

• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required
• Scope (Jump Point): No

Google Chrome Zero-Day Is Being Weaponized

Google has released 94.0.4606.61 today to the Stable Channel to resolve serious issues impacting Windows, Linux and Mac OS.

This year Google has released 11 zero-day versions of the Chrome browser. This vulnerability is being tracked under CVE-2021-37973 as a High Severity.

This zero-day is due to a vulnerability in the ‘use-after-free’ error when processing HTML content within the Portals component. A remote attacker can create a specially-crafted website, trick the victim into visiting it, trigger a use-after-free error, and execute arbitrary code on the system.

What’s the solution?

Upgrade to the latest version of Chrome stable channel using Syxsense Secure.

Syxscore Risk Alert

This vulnerability has a serious risk as this can be exposed over any network, with low complexity and without privileges. The CVE carries a CVSS score of 8.4 (High Severity) and the vulnerability is being weaponized.

• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required
• Scope (Jump Point): No

Chrome Zero-Day Is Currently Weaponized

Google has released 93.0.4577.82 today to the Stable Channel and is impacting Windows, Linux and Mac OS, fixing a total of 9 vulnerabilities.

This year Google have released 10 zero-day versions of Chrome. One of the bugs, tracked as CVE-2021-30632, is an out-of-bounds write which if exploited could compromise the entire system.

The vulnerability exists due to a boundary error when processing untrusted HTML content in V8.  A remote attacker can create a specially crafted web page, trick the victim into opening it, and execute arbitrary code on the target system. This has been reported to be weaponized.

What’s the solution?

Upgrade to the latest version of Chrome stable channel using Syxsense Secure.

Syxscore Risk Alert

This vulnerability has a serious risk as this can be exposed over any network, with low complexity and without privileges. The CVE carries a CVSS score of 8.8 (High Severity) and the vulnerability is being weaponized.

• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required
• Scope (Jump Point): No

Chrome Zero-Day Is Currently Weaponized

Google has released 91.0.4472.114 today to the Stable Channel and is impacting Windows, Linux and Mac OS, fixing a total of 4 vulnerabilities. Google has released at least one zero-day version of Chrome each month in 2021.

One of the bugs, tracked as CVE-2021-30554, exists due to a use-after-free error within the WebGL component in Google Chrome.  A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system. and has been reported to be weaponized.

Solution

Upgrade to the latest version of Chrome or later using Syxsense Secure.

Syxscore Risk Alert

This vulnerability has a significant risk as this can be exposed over any network, with low complexity and without privileges.  The CVE carries a CVSS score of 8.4 (High Severity)  the vulnerability is being weaponized.

• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required
• Scope (Jump Point): No

Chrome Zero-Day Is Currently Weaponized

Google has released 91.0.4472.101 today to the Stable Channel and is impacting Windows, Linux and Mac OS, fixing a total of 14 vulnerabilities. This year Google released at least one zero-day version of Chrome each month.

One of the bugs, tracked as CVE-2021-30551, exists due to a use-after-free error within the BFCache component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system and has been reported to be weaponized.

Solution

Upgrade to the latest version of Chrome or later using Syxsense Secure.

Syxscore Risk Alert

This vulnerability has a significant risk as this can be exposed over any network, with low complexity and without privileges. The CVE carries a CVSS score of 8.7 (High Severity)  the vulnerability is being weaponized.

This vulnerability if exposed, has a Scope (Jump Point) of True, which means it can be used to transfer into another part of the system making this more serious.

• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope (Jump Point): Yes

Chrome Zero-Day Is Currently Weaponized

Google has released Chrome_v9 90.0.4430.212 today to the Stable Channel and is impacting Windows, Linux and Mac OS, fixing a total of 43 vulnerabilities. So far this year, Google released at least one zero-day version of Chrome each month.

One of the bugs, tracked as CVE-2021-28550, is a use-after-free memory corruption flaw that affects Adobe Reader for Windows that has been reported to be weaponized.

Solution

Upgrade to the latest version of Chrome or later using Syxsense Secure.

Syxscore Risk Alert

This vulnerability has a significant risk as this can be exposed over any network, with low complexity and without privileges.  The CVE carries a CVSS score of 7.8 (High Severity)  the vulnerability is being weaponized.

• Attack Vector: Local
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required
• Scope (Jump Point): No

Google Warns of Newly Exploited Zero-Day Flaw

Google has released Chrome_v90.0.4430.85 today to the Stable Channel and is impacting Windows, Linux and Mac OS, fixing a total of 7 vulnerabilities. This year, Google has released at least one zero-day version of Chrome each month.

The vulnerability exists due to a type confusion error within the V8 browser engine in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger a type confusion error and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

How to Resolve the Chrome Zero-Day

Upgrade to the latest version of Chrome or later using Syxsense Secure.

Syxscore Risk Alert

This vulnerability has a significant risk as this can be exposed over any network, with low complexity and without privileges.  The CVE carries a CVSS score of 8.8 (High Severity)  the vulnerability is being weaponized.

• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required
• Scope (Jump Point): No

Google Warns of New Zero-Day

Google has released Chrome_v89.0.4389.90 to the Stable Channel for Windows, Linux and Mac OS, fixing a total of 8 vulnerabilities. Google has released three zero-day versions of Chrome this year.

The vulnerability exists due to a use-after-free error within Blink component in Google Chrome. A remote attacker can create a specially crafted webpage, trick the victim into visiting it, trigger a use-after-free error and execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

How to Resolve the Chrome Zero-Day

Upgrade to the latest version of Chrome_v89.0.4389.90 or later using Syxsense Secure.

Syxscore Risk Alert

This vulnerability has a significant risk as this can be exposed over any network, with low complexity and without privileges. Although the latest CVE carries a CVSS score of 8.4 (High Severity), the vulnerability is being weaponized.

• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required
• Scope (Jump Point): No