Google released security updates on Monday to address a significant vulnerability in its Chrome web browser that is actively being exploited. The vulnerability, identified as CVE-2023-3079, is a type confusion bug in the V8 JavaScript engine. It was reported by Clement Lecigne of Google's Threat Analysis Group (TAG) on June 1, 2023.
According to the National Vulnerability Database (NVD) maintained by the NIST, the flaw in Chrome prior to version 114.0.5735.110 could allow a remote attacker to potentially exploit heap corruption through a specially crafted HTML page.
Google has confirmed the existence of an exploit for CVE-2023-3079 in the wild, but has not provided specific details about the attacks.
This marks the third actively exploited zero-day vulnerability that Google has addressed in Chrome this year. The previous two vulnerabilities were:
CVE-2023-2033 (CVSS score: 8.8) – Type Confusion in V8
Google has recently addressed a high-severity vulnerability, identified as CVE-2023-2033, in its Chrome web browser. This specific flaw, classified as a type confusion bug in the V8 JavaScript engine, has been assigned a Common Vulnerability Scoring System (CVSS) score of 8.8. It is crucial to note that this vulnerability was actively exploited in the wild.
The National Vulnerability Database (NVD), maintained by the National Institute of Standards and Technology (NIST), describes the issue as a potential remote attack vector that could lead to type confusion within the V8 engine. This can ultimately result in a heap corruption, endangering the security and stability of the browser.
Unfortunately, Google has not disclosed explicit details regarding the nature of the attacks associated with CVE-2023-2033. However, it is important to address this vulnerability promptly to protect systems from potential compromise.
To mitigate the risks associated with this vulnerability, users are strongly advised to update their Chrome browser to the latest version. By doing so, users can ensure that the necessary security patches have been applied to safeguard against potential exploits.
As always, maintaining up-to-date software and promptly applying security updates is essential for maintaining a secure browsing environment.
CVE-2023-2136 (CVSS score: 9.6) – Integer overflow in Skia
A critical vulnerability, identified as CVE-2023-2136, has been discovered in Google Chrome. This vulnerability has received a CVSS score of 9.6, indicating its severity. The flaw specifically relates to an integer overflow issue within the Skia graphics library.
The National Vulnerability Database (NVD), managed by the National Institute of Standards and Technology (NIST), describes CVE-2023-2136 as a potential attack vector that can be exploited remotely. The integer overflow in Skia can lead to memory corruption, potentially enabling malicious actors to execute arbitrary code on affected systems.
Google has taken prompt action to address this vulnerability by releasing security updates for the Chrome browser. Users are strongly advised to update their Chrome installations to the latest version available. By doing so, users can protect their systems from potential attacks leveraging this particular vulnerability.
It is worth noting that specific details regarding the exploitation of CVE-2023-2136 have not been publicly disclosed. However, the severity of the vulnerability underscores the importance of applying security patches as soon as they become available.
Ensuring the timely installation of software updates is essential for maintaining the security and integrity of systems, as it helps protect against known vulnerabilities and emerging threats.
To safeguard against potential threats, users are advised to update their Chrome browser to version 114.0.5735.110 on Windows and 114.0.5735.106 on macOS and Linux. Users of Chromium-based browsers, including Microsoft Edge, Brave, Opera, and Vivaldi, should also apply the necessary fixes as soon as they become available.
For more exclusive content, follow us on Twitter and LinkedIn.
Olivia Morelli is a senior media writer on Reviewedbypro.com. Her favorite topic to write about is ransomware attacks and how to deal with them, but she also enjoys covering the topics of other types of malware and VPNs.
