Google Fixes More Chrome Zero-days Exploited In The Wild

Google has released Chrome 86.0.4240.198 for Windows, Mac, and Linux to address two zero-day vulnerabilities exploited in the wild.

Google Chrome 86.0.4240.198 will roll out over the coming days. To upgrade, you have to go to Settings -> Help -> ‘About Google Chrome’ to allow the browser to automatically check for the new update and install it when available.

Zero-day details not available

The two security flaws were reported to Google by anonymous researchers, but the company did not provide any information regarding the attacks that abused them or the threat actors behind them.

One of the zero-days, tracked as CVE-2020-16013 and reported on Monday, is described as an inappropriate implementation in V8, Google’s open-source and C++ based high-performance WebAssembly and JavaScript engine.

Also Read: What Legislation Exists in Singapore Regarding Data Protection and Security?

The second one is tracked as CVE-2020-16017 (reported on Saturday) and is a use after free bug in the Chrome Site Isolation that could lead to the execution of arbitrary code.

“Access to bug details and links may be kept restricted until a majority of users are updated with a fix,” Google said.

“We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven’t yet fixed.”

Five Chrome zero-days patched within a month

In total, also counting CVE-2020-16013 and CVE-2020-16017, Google has patched five zero-days exploited in the wild since October 20.

With the release of Chrome 86.0.4240.111, the company fixed an actively exploited 0day in the FreeType text rendering library (CVE-2020-15999) discovered by Google’s Project Zero bug-hunting team.

On November 2, Chrome 86.0.4240.183 patched another zero-day exploited in the wild, a remote code execution (RCE) vulnerability tracked as CVE-2020-16009.

On the same day, Google fixed another zero-day in Chrome for Android (CVE-2020-16010), a sandbox escape vulnerability also exploited in the wild.

Project Zero researchers also disclosed a Windows kernel elevation of privileges (EoP) zero-day (CVE-2020-17087) affecting systems running Windows 7 or later and actively exploited in targeted attacks.

Also Read: Advisory Guidelines on Key Concepts in the PDPA: 23 Chapters

The vulnerability impacts desktop systems running Windows 7 or later and servers running Windows Server 2008 and higher and it was patched by Microsoft in this month’s Patch Tuesday.