A zero-day safety vulnerability in Google Chrome for Android is being actively exploited within the wild, the Web big says.
The problem is a high-severity heap-buffer overflow bug (tracked as CVE-2022-2294) in WebRTC. WebRTC is an HTML5 specification that permits webpages to play real-time audio and video content material contained in the browser.
“Google is conscious that an exploit for CVE-2022-2294 exists within the wild,” the corporate stated in its advisory on the problem.
As typical, Google is retaining the vulnerability’s technical particulars near the vest till a majority of customers have up to date their browsers, however heap-buffer overflows
generally are reminiscence points that may result in a spread of dangerous outcomes if exploited. Attainable outcomes embody crashing the gadget, denial of service (DoS), distant code execution (RCE), and security-service bypasses.
Patrick Tiquet, vp of safety and structure at Keeper Safety, did some delving into the problem, and says that bug does certainly permit RCE.
“CVE-2022-2294 is a severe vulnerability that would result in arbitrary distant code-execution by merely visiting a malicious web site,” he says. “This might allow an attacker to carry out a wide range of actions on a goal system, comparable to set up malware or steal info. Home windows and Android Chrome customers ought to make sure that they set up the most recent updates to guard themselves.”
To handle the flaw, Google launched Chrome 103 (103.0.5060.71) for Android on Monday – it stated that the replace can be rolling out on Google Play “over the following few days.”
The replace fixes two different safety bugs as properly: One is a high-severity type-confusion bug (CVE-2022-2295) in Google’s V8 open supply JavaScript engine, which earned a $7,500 bug bounty for reporters avaue and Buff3tts at S.S.L.; and the opposite is an unspecified repair that was found internally. Sort-confusion points may also result in code execution, crashes, and logical efforts.
Tiquet provides, “Net browsers are important functions that just about all cloud-based companies have in frequent and are due to this fact high-priority targets – compromise of an online browser might be leveraged to compromise any cloud-based service accessed by that browser.”
Fourth Exploited Chrome Zero-Day Bug in 2022
The WebRTC flaw is the fourth zero-day in Chrome to date this yr. Notably, in April Google disclosed a type-confusion vulnerability that’s already being exploited within the wild (CVE-2022-1364), which impacts the JavaScript and WebAssembly engine within the browser.
One other type-confusion drawback in V8 (CVE-2022-1096) was patched in March; and the third was patched in February (CVE-2022-0609), after it was exploited by a North Korean-backed state superior persistent risk, in keeping with the Google Menace Evaluation Group (TAG).
“With so many enterprise and cloud functions relying on an online interface, browser vulnerabilities might be problematic,” Mike Parkin, senior technical engineer at Vulcan Cyber, says. “Particularly one as extensively used as Chrome. It’s even worse when there are recognized exploits within the wild that leverage the vulnerability. Fortuitously, Google has already developed patches for this vulnerability on each desktop and cellular platforms and can have them rolled out rapidly.”
