Google Chrome Replace Fixes High-Severity Zero-Day Vulnerability That Was Actively Exploited

Google is rolling out a safety patch for its Chrome internet browser that fixes a safety flaw that might permit a malicious person to run harmful code on a person’s pc. The replace is out there for Windows, macOS, and Linux computer systems and customers ought to set up the most recent model as a way to stay protected against the zero-day vulnerability — the sixth one to be patched by Google this 12 months. The firm is anticipated to offer extra info as soon as the replace has been rolled out to a number of customers.

Spotted by Android Central, the replace to Google Chrome 119.0.6045.199 for macOS and Linux started rolling out to customers earlier this week, alongside model 119.0.6045.200 for Windows computer systems with a repair for a zero-day vulnerability in tow. These are flaws that have been beforehand unknown to the builders of the software program, making them a goal for malicious customers.

With the most recent Google Chrome replace, the corporate has patched the safety bug tracked by the National Institute of Standards and Technology (NIST) as CVE-2023-6345. While the corporate hasn’t revealed an excessive amount of info associated to the safety flaw, the agency says it is aware of that “an exploit for CVE-2023-6345 exists in the wild” in its launch notes for the most recent replace. Users ought to allow automated updates for Chrome or manually replace to the most recent variations as a way to get the most recent fixes.

Meanwhile, the entry for the vulnerability on the NIST web site has been assigned a “High” severity degree. The description states that it’s associated to the open supply Skia library that’s utilized in Google Chrome. An attacker may use a malicious file to compromise the renderer course of and escape the sandbox — a system designed to separate the browser and the system, to maintain the latter protected.

The firm credit Benoît Sevens and Clément Lecigne from its Threat Analysis Group (TAG) with discovering the vulnerability that was discovered on November 24 and swiftly patched by the corporate. At the second, it’s unclear whether or not different browsers and functions which might be additionally primarily based on Google’s open-source Chromium browser mission are additionally affected by the flaw, or when they’ll obtain updates with safety patches.