Google Patches One More Actively Exploited Chrome Zero-day

Google today released Chrome 86.0.4240.183 for Windows, Mac, and Linux to address 10 security vulnerabilities including a remote code execution (RCE) zero-day exploited in the wild.

The zero-day was reported by Clement Lecigne of Google’s Threat Analysis Group and Samuel Groß of Google Project Zero on October 29, 2020.

No details regarding in the wild attacks

The RCE vulnerability is tracked as CVE-2020-16009 and it is described as an inappropriate implementation in V8, Google’s open-source and C++ based high-performance WebAssembly and JavaScript engine.

While Google says that it “is aware of reports that an exploit for CVE-2020-16009 exists in the wild,” the company did not provide any details regarding the threat actors behind these attacks.

“Access to bug details and links may be kept restricted until a majority of users are updated with a fix,” Google adds.

“We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven’t yet fixed.”

Also Read: Letter of Consent MOM: Getting the Details Right

Today, Google patched another zero-day in Chrome for Android exploited in the wild, a sandbox escape vulnerability tracked as CVE-2020-16010.

Today Chrome fixed two more vulnerabilities that were being actively exploited in the wild (discovered by Project Zero/Google TAG last week). CVE-2020-16009 is a v8 bug used for remote code execution, CVE-2020-16010 is a Chrome sandbox escape for Android. https://t.co/IOhFwT0Wx1

— Ben Hawkes (@benhawkes) November 2, 2020

CVE-2020-16009 is the second actively exploited Chrome zero-day patched within the last two weeks after a heap buffer overflow zero-day bug found in the FreeType text-rendering library.

Last week, Google’s Project Zero 0day bug-hunting team disclosed an actively exploited Windows kernel elevation of privileges (EoP) zero-day tracked as CVE-2020-17087, affecting all versions between Windows 7 and Windows 10.

Six other security flaws addressed

Google also fixed six other high severity security vulnerabilities in Chrome 86.0.4240.183:

• CVE-2020-16004: Use after free in user interface. Reported by Leecraso and Guang Gong of 360 Alpha Lab working with 360 BugCloud on 2020-10-15
• CVE-2020-16005: Insufficient policy enforcement in ANGLE. Reported by Jaehun Jeong(@n3sk) of Theori on 2020-10-16
• CVE-2020-16006: Inappropriate implementation in V8. Reported by Bill Parks on 2020-09-29
• CVE-2020-16007: Insufficient data validation in installer. Reported by Abdelhamid Naceri (halov) on 2020-09-04
• CVE-2020-16008: Stack buffer overflow in WebRTC. Reported by Tolya Korniltsev on 2020-10-01
• CVE-2020-16011: Heap buffer overflow in UI on Windows. Reported by Sergei Glazunov of Google Project Zero on 2020-11-01

Chrome 86.0.4240.183 is rolling out to users during the next days/weeks. Desktop users can upgrade by going to Settings -> Help -> About Google Chrome.

Also Read: CCTV Law Singapore Edition: Know Your Rights and Responsibilities

The web browser will then automatically check for the new update and install it when available.

Update November 02, 16:52 EST: Added info on actively exploited zero-day in Chrome for Android.