Google has updated its Chrome web browser, fixing 4 bugs with a severity rating of “high” and 8 overall. 3 are use-after-free flaws, which could allow an adversary to create an error in the browser’s memory, opening the door to a browser hack & host computer compromise.
Desktop versions of the browser received a total of 8 fixes, half rated ‘high-severity.’
On Fri., the US Cybersecurity & Infrastructure Security Agency (CISA) issued a security bulletin asking users & infosec administrators to apply the update. The agency warned that the vulnerabilities can be used by an attacker “to take control of an affected system.”
According to Google’s Dec. security bulletin, previous Windows, macOS & Linux versions of the Chrome desktop browser are vulnerable to attacks. An updated 87.0.4280.88 version of Chrome addresses the bugs & will “roll out over the coming days/weeks,” Google wrote.
Manually Update of Your Chrome Browser
To manually update your Chrome browser, visit Chrome’s customisation drop-down menu in the upper-right hand side of the client. From that menu select “Help” & then “About Google Chrome.” Opening that menu item automatically triggers Chrome to look for updates.
Details linked to each of the bugs are being withheld at this time, Google explained, “until a majority of users are updated with a fix.” It also noted that when & if bugs exist in 3rd-party code libraries used in other devices or platforms, technical details of the bugs will be restricted.
Unique Linux Flaw
3 high-severity bugs each include use-after-free elements impacting memory, tied to Chrome’s clipboard, media & extensions components. The bugs are tracked as CVE-2020-16037, CVE-2020-16038 and CVE-2020-16039.
However, cyber-security researchers have described these types of un-initialised-use bugs as “largely overlooked” & often “regarded as insignificant memory errors.”
“These are actually a critical attack vector that can be reliably exploited by hackers to launch privilege-escalation attacks in the Linux kernel,” outlines 2017 research published by the Georgia Institute of Technology.
A 2nd medium-severity bug (CVE-2020-16041) is an “out-of-bounds read in networking” vulnerability. This could let an adversary improperly access objects in memory.
Technical details of the CVE are also being withheld, but this type of vulnerability could allow an unauthenticated adversary to send a malformed message to vulnerable software. Due to insufficient validation of the message, the targeted program could be forced to crash.
Google acknowledged several security researchers that contributed to identifying this month’s bugs.
Ryoya Tsukasaki was thanked for finding the use-after-free bug (CVE-2020-16037) in the Chrome clipboard, which earned the researcher a $5,000 bug bounty. Khalil Zhani, Lucas Pinheiro, Sergei Glazunov, André Bargull & Mark Brand were also credited for their bug-hunting.